Taobao has been attacked on a huge scale. Here we discuss some lessons learned on how to handle your logging in this situations.
It seems the attackers didn’t attempt to breach Taobao’s own systems but used a very large database of usernames and passwords that stem from previous hacks of various other websites. They then used these credentials for massive automated login attempts to Taobao.com. Because many people use the same name and password on different websites, a number of these login attempts were successful. What makes this particular case special is the dimension: Reports say the hackers executed approximately 100 million login attempts, and almost 21 million of these turned out to be successful.
Proactive, automated detection of unusual activity, like anomaly detection, is a must-do. The complexity of modern websites and their levels of traffic result in log data volumes that can only be machine-monitored.