FC: Microsoft websites blacked out -- but what happened?

[kelley]

At 05:19 PM 1/24/01 -0500, Marco Anglesio wrote:
>On Wed, 24 Jan 2001, kelley wrote:
> > That said, this remains a mystery. Why would it take so long to get even
> > one of those computers back online? Any network admins want to speculate?
>
>I'm not a network admin, but my guess is that one or all of those machines
>have been compromised, possibly because of an existing software hole, and
>they're keeping DNS shut down until they can all be rebuilt from scratch.
>
>Btw, I don't think that those machines are necessarily close together. The
>IPs are, but the IPs probably translate to dispersed locations inside the
>MSFT firewall. Or so I'd expect. But perhaps I expect too much.

heh.

i didn't write that, declan mccullagh did.  we discovered it last night, 
around 1 a.m. e.s.t.  slate was down.

nameserver DDoS.  dunno.  i'm inclined, since that's the boss's thang.  i 
don't know why declan things they're physically close together.  it 
wouldn't make a whole lot of sense, iyam.  the microsoft rep on nanog isn't 
peeping, of course, but this is what he said:

<forwarded>
Microsoft's ITG is investigating this issue. I haven't been clued in as of 
yet as to what is the main issue. Hotmail's graphs and logins are currently 
following the same trends as normal, they seem unaffected, however this is 
not the case in all locations. DNS seems to be the obvious choice for the 
blame. This is not the case in all areas, however. At this point Microsoft 
is not willing to put the blame on anyone, or any protocol for that matter. 
(Unless they already released a public statement saying so, then who 
knows?) Anyway, the issues are being worked on and service will be restored 
as soon as possible. I apolozise for not being able to disclose more 
information. -- Dave McKay dave at sneakerz.org Microsoft Global Network 
Architect
</backwarded>