F-Secure received its first sample, msblast.exe, at 19:22 GMT on Monday 11 August 2003. Blaster, also called Lovsan and MSBlast, used the hole in the Remote Procedure Call service of Windows 2000 and XP that Microsoft had patched on 16 July (July 2003). It came in through TCP port 135, and each new victim fetched the worm from its attacker through a built-in TFTP server. On many XP machines the attack crashed the RPC service, and a warning appeared that Windows would shut down within 60 seconds; typing shutdown -a stopped the countdown. Inside the code, never displayed, were two lines: “I just want to say LOVE YOU SAN!!” and “billy gates why do you make this possible ? Stop making money and fix your software!!”
On Tuesday 12 August Johannes Ullrich of the SANS Internet Storm Center estimated about 30,000 infected machines worldwide, and, by press reports, Maryland's Motor Vehicle Administration closed its offices; by that Friday Symantec put the total at more than 423,000. The worm also carried a date. From 16 August infected machines were to flood windowsupdate.com, an address that merely passed visitors on to the real service at windowsupdate.microsoft.com, and before the day came Microsoft took it out of service, so the flood had nowhere to land. In April 2004 Microsoft, by press accounts, gave a count of its own: its clean-up tool had been run on at least eight million machines, and Windows Update had found Blaster on more than sixteen million, a figure that may count some twice.
On Monday 18 August a second worm came through the same hole, and through the WebDAV flaw of March against IIS 5.0 servers. Welchia, or Nachi, found machines by pinging them, deleted Blaster, fetched Microsoft's patch, installed it and restarted the machine; a note in its code began “I love my wife & baby :)” and promised to remove itself in 2004. Its pinging did the damage: that afternoon it reached the unclassified side of the Navy-Marine Corps Intranet, where, by the Navy's account, it clogged email, the web and shared drives, in effect a denial-of-service attack nobody had intended. The next day, by press reports, Air Canada's check-in systems were hit and its flights were delayed.
Blaster's original author left no trail anyone could follow; the copyists did. On Friday 29 August federal agents arrested Jeffrey Lee Parson, 18, of Hopkins, Minnesota, over Blaster.B, which, prosecutors said, he had released on 12 August with a back door, seeding it through about fifty computers he had hijacked. Early in September a 24-year-old in Iasi was arrested over Blaster.F, by the account of the Romanian anti-virus company Softwin; he was charged under a new cybercrime law, and we found no record of a verdict. Parson pleaded guilty in August 2004; on 28 January 2005, the government putting his variant's victims at more than 48,000, he was sentenced to eighteen months. The judge, noting that he had been three weeks past his eighteenth birthday when he released it, told him: “No video games, no chat rooms.”
Twenty Servers
Sobig.F went out at 19:46 GMT on Monday 18 August 2003, posted to six alt.binaries newsgroups as “Nice, who has more of it? DSC-00465.jpeg” through Easynews, a Phoenix Usenet provider. The account, by later accounts, had been opened with a stolen credit card only minutes before and used once. F-Secure found the worm the next day. The sixth Sobig mailed itself under subjects such as “Re: Thank you!” and “Your details”, forging senders from addresses on the disk, and the mail-filtering firm MessageLabs reported more than a million copies in its first 24 hours, at a peak of about one email in seventeen, more than it had seen from any virus before. The family's first version had installed proxies that spammers used; this one kept an appointment. At 19:00 GMT on Friday 22 August each copy was to ask one of twenty computers in the United States, Canada and South Korea for the address of a program to download and run. By the deadline, by the reports of the day, all but one had been taken offline, and the last soon followed. Sobig.F was built to stop spreading on 10 September; MyDoom passed its record in January 2004.
Two Control Rooms
On Tuesday 19 August 2003 Kevin Poulsen of SecurityFocus reported what Slammer had done in January inside the Davis-Besse nuclear plant in Ohio, offline since February 2002. The worm had crossed from a contractor's unsecured network over a T1 line that bypassed the plant's firewall — “in essence a backdoor from the Internet to the Corporate internal network,” a FirstEnergy official wrote to the Nuclear Regulatory Commission, which the company had told in April. On 25 January the plant's Safety Parameter Display System crashed at 4:50 p.m. and took four hours and fifty minutes to restore; the breach, Poulsen reported, posed no safety hazard. By then FirstEnergy's other control room was under investigation. On Thursday 14 August a blackout spread across eight states and Ontario, affecting an estimated 50 million people, some for four days. In April 2004 the US–Canada task force reported that the alarm software in FirstEnergy's control room had failed shortly after 14:14 EDT, unnoticed there for over an hour, and found no evidence that worms or viruses then circulating, Blaster among those studied, had affected the power systems of the companies involved.
Blocked by the Providers
On Thursday 14 August 2003 The Tribune's Chandigarh pages carried a short report, datelined the day before: a computer virus, “Worm -32”, had hit the city's internet users over the past few days, and local internet service providers had taken steps to block it. It was reported, the paper said, to have attacked computers in several government offices in Chandigarh, Punjab and Haryana. The report named no office and gave no count, but it did name the worm: citing Symantec's website, it identified it as W32.Blaster.Worm, the one that fetched msblast.exe. CERT-In, formally set up only in January 2004, had posted its Blaster advisory on 12 August, as January 2004 records.
The internet those offices used turned eight on 15 August, by the reckoning of The Tribune's IT supplement of 11 August: about 5 million users shared 1.5 million connections, and dial-up was billed as local calls, about Rs 30 an hour to BSNL or MTNL, among the highest charges in the world. On 20 August BSNL offered new subscribers in Chandigarh fifty free hours of internet. On 25 August the supplement told its readers of Welchia, the worm that removed Lovsan and installed Microsoft's patch. We found no record of how many machines “Worm -32” reached, or which offices. Fourteen years later a worm through a Windows service again reached Indian government desks, on a small scale: WannaCry's confirmed Indian footprint was police units in Andhra Pradesh, a panchayat office in Kerala and a state electricity distributor in West Bengal (May 2017).
IJCAI meets in Acapulco, ICML in Washington
The Eighteenth International Joint Conference on Artificial Intelligence met in Acapulco from 9 to 15 August 2003, with 189 papers on its technical programme. Its Computers and Thought Award went to Tuomas Sandholm of Carnegie Mellon, whose lecture argued that bidders' limited computing could spoil the incentives built into auctions, while computational complexity could deter manipulation; Nils Nilsson took the award for research excellence. AAAI's robot challenge asked machines to find the registration booth, register and give a talk, and its two entrants capped three days of robot events by speaking and taking questions. From 21 to 24 August the International Conference on Machine Learning met at the Omni Shoreham in Washington, alongside KDD and COLT. Two of its papers won ICML's classic-paper prizes in 2013: Xiaojin Zhu, Zoubin Ghahramani and John Lafferty's semi-supervised learning, spreading a few labels through a graph of similar examples, and Martin Zinkevich's online convex programming, for choices made before their costs are revealed. Libratus, which Sandholm built with Noam Brown, beat four poker professionals in January 2017.
Norton and McAfee go after spyware
On Monday 25 August 2003, after a fortnight of worms, Symantec and Network Associates announced anti-virus updates that went after more than viruses. Norton AntiVirus 2004, due in early September at $49.95, would detect spyware and keystroke loggers, flagging known ones in email and instant-message attachments and reporting those already installed; Symantec's research had found spyware a leading worry among users, “a big ticket issue for our user base”, said Kelly Martin, its senior product manager. It would flag legal adware such as Gator but not remove it automatically, since a licence accepted at installation often covered it. McAfee VirusScan would also remove spyware and adware, and its WormStopper, watching for bursts of repetitive outgoing mail, would slow mass-mailers such as Sobig.F, Network Associates said, though not stop infections. The next day EarthLink sued two rings it could not yet name, in Birmingham, Alabama, and Vancouver, over more than 250 million spam messages and phishing. By April 2004 Gator, renamed Claria in October, was warning prospective investors that such detectors could shrink its audience.
⏳ Time capsule — August 2003
- On 16 August the International Union of Pure and Applied Chemistry officially recommended the name darmstadtium for element 110, after Darmstadt, where a team at GSI under Sigurd Hofmann had first made it on 9 November 1994; the discoverers had also considered wixhausium, after the suburb where it was found.
- On 27 August Mars passed about 55.76 million kilometres from Earth, nearer than at any time in almost 60,000 years; it will come closer in 2287. An email circulating that summer promised that it would look as large as the full Moon, a misreading of a line about its size through a 75-power telescope.
- On 29 August Skype, founded by Niklas Zennström and Janus Friis and written by the Estonians Ahti Heinla, Priit Kasesalu, Jaan Tallinn and Toivo Annus, released its first public beta: internet telephony on a peer-to-peer model drawn from Kazaa, named from “sky” and “peer-to-peer” by way of Skyper, some of whose domain names were taken.
- On 30 August, at the Stade de France in Saint-Denis, Anju Bobby George jumped 6.70 metres for bronze in the long jump at the World Championships in Athletics, behind Eunice Barber of France and Tatyana Kotova of Russia: the first medal any Indian athlete had won at the championships.
After the Restart
Blaster outlived its month. Microsoft's removal tool, pushed through Windows Update, was still hunting it in January 2005, and the worms that followed kept to its pattern, a hole in a Windows network service and machines that restarted on their own: Sasser in May 2004, and Zotob, at CNN while its anchors reported the outbreak, in August 2005. Welchia's idea, mending strangers' computers without asking, found a sanctioned echo in April 2021, when the FBI, under a court order, made web shells on hundreds of American Exchange servers delete themselves and told the owners afterwards.
The authors mostly stayed out of reach. In November Microsoft put a bounty on Blaster's original author; on every record we found, he has never been identified, and the arrests of 2003 were for copies. The blackout task force cited Slammer's visit to Davis-Besse as an example of untargeted code reaching the power sector, and asked for cyber and physical security standards there to be promulgated and enforced. The first blackout publicly acknowledged as the work of intruders came in Ukraine on 23 December 2015 (December 2015), where breakers opened while the dispatchers were locked out of their own consoles.