News
Microsoft June Service Outages Due to Denial of Service Attacks
- By Kurt Mackie
- June 20, 2023
Microsoft on Friday explained that its "early June" service outages happened because of distributed denial of service (DDoS) interruptions by an attacker labeled "Storm-1359."
Microsoft had a couple of major service outages in that time period. On June 5, the Outlook on the Web service had problems, which at the time was said to have been due to a bad service update. On June 9, the Azure Portal had service interruptions.
The announcement was not clear on which outages had been subject to the DDoS attacks.
The early June attacks were carried out by Anonymous Sudan, according to this AP story, citing a Microsoft spokeswoman. Microsoft's announcement, though, used the Storm name instead, which is a temporary designation reserved for unknown or emerging threat activity. Microsoft recently switched to a new security nomenclature based on bad weather themes, which was announced in April.
Media reports have described Anonymous Sudan as a "hacktivist" group or as Russian or Russian affiliated, but Microsoft's announcement did not elaborate on the identity of the perpetrators.
The early June service outages occurred via DDoS attacks at "layer 7 rather than layer 3 or 4," the announcement explained. Layer 7 is used for application load balancing under the Open Systems Interconnect Model. The attackers likely used "rented cloud infrastructure" and "multiple virtual private servers," plus "a collection of botnets and tools," to carry out the DDoS attacks.
A few main techniques were used by the attackers to slow the traffic. An "HTTP(S) flood" attack pushed a "a high load of SSL/TLS handshakes and HTTP(S) requests." A "cache bypass" attack used a series of queries to "force the frontend layer to forward all the requests to the origin," rather than to the cache. Also, a "Slowloris" attack was used, where download acknowledgments aren't recognized or they get delayed, which "forces the web server to keep the connection open and the requested resource in memory."
Microsoft's announcement oddly ended with steps for organizations to better protect their layer 7 implementations from DDoS attacks. For its part, Microsoft indicated that it had hardened its layer 7 protections in response, "including tuning Azure Web Application Firewall (WAF) to better protect customers from the impact of similar DDoS attacks."
About the Author
Kurt Mackie is senior news producer for 1105 Media's Converge360 group.