While Microsoft has a track record of deflecting DDoS attacks, the SCO Group’s ability to defend its web site is complicated by the company’s legal battle with Linux users. Both companies will be targeted Sunday by denial of service attacks from Windows computers infected by the MyDoom worm.
Content distribution networks (CDN) can play a key role in defeating DDoS attacks, using their large and widely distributed networks of servers to blunt their impact. Microsoft used a CDN service from Akamai to keep its web site online last August, when the Blaster worm programmed machines to launch a DDoS on the Windows Update site. Microsoft’s strategy drew considerable attention, as the front page of the www.microsoft.com site was served by Linux machines on Akamai’s network.
The largest CDN providers - Akamai, Cable & Wireless and Speedera - all make extensive use of Linux servers. That’s a problem for SCO, which contends that Linux includes copyrighted code from its own operating system, and is asking Linux users to pay $699 per server for the right to use its intellectual property. It’s implausible that any of the CDN providers would pay this licence fee. If SCO feels that it is unable to patronise a very prominent Linux user, this eliminates one of the most proven defences and contrasts strongly with Microsoft’s practical and prosaic approach.
That dilemma may explain why the sco.com site has been very slow to load for more than a day even though the anticipated DDoS from MyDoom-infected computers isn’t triggered until Sunday. The company has publicly attributed the outage to a DDoS, and has a history of failure deflecting such attacks. People have speculated that the current slowness of response from the site may be caused by traffic from infected machines with incorrect system dates, by seperate DDoS attacks unrelated to the virus, or simply by bona fide http traffic caused by the number of articles written recently that include a url to the SCO site.
The spread of the MyDoom worm variants may provide a sterner test for Microsoft than Blaster, which is estimated to have controlled 220,000 windows machines. Estimates of the number of computers infected by MyDoom range from 300,000 to as high as 600,000. Presently, Microsoft is using AKamai for DNS services, but is serving the front page of www.microsoft.com directly from Redmond.
% ping www.microsoft.com PING www2.microsoft.akadns.net (207.46.134.157): 56 data bytes %whois -a 207.46.134.157 OrgName: Microsoft Corp OrgID: MSFT Address: One Microsoft Way City: Redmond StateProv: WA PostalCode: 98052 Country: US NetRange: 207.46.0.0 - 207.46.255.255
It will be interesting to see if Microsoft introduces Akamai http caching for the front page of www.microsoft.com in the run up to Sunday.