The message to Bugtraq, the security mailing list, was stamped 14:44 GMT on Tuesday 9 December 2003 and signed by a researcher writing as Zap The Dingbat. Internet Explorer, it said, could misreport where a page came from. Put a non-printing character — the byte 0x01, written %01 — before the @ sign in a web address, and the browser displayed only what preceded it, in the address bar and the status bar alike, while fetching the page from the host named after the @. On the author's demonstration pages, www.microsoft.com sat over content served from zapthedingbat.com. Microsoft, the post said, had been told that day. It was also Microsoft's monthly release day, under the schedule told in October, and for December it had no security bulletins to publish.
The form it abused was old and legitimate. An address could carry a user name and password before an @, for sites using basic authentication, and Internet Explorer had accepted them since version 3.0. Everything before the @ was ignored in locating the server, so the position suited disguise: the Anti-Phishing Working Group later found the plain form in nearly a third of the phishing attacks reported to it in January 2004. Internet Explorer 6's first service pack had begun showing only the real host; the %01 reversed that, and CERT/CC found a null character did the same. Scammers took nine days to start using it, by the working group's account, with an attack on Visa's cardholders reported on 18 December; within days, the SANS Internet Storm Center reported, EarthLink's customers were being told their cards could not be billed, in mail whose links the bug made look genuine.
For eight weeks there was no fix from Microsoft. A free patch from Openwares.org, an open-source site, carried a buffer overflow of its own, Germany's Heise found, and was withdrawn and reissued before Christmas. Microsoft's interim advice, in a support article, was that the most effective protection was not to click links but to type addresses in, and to paste a doubtful link into Notepad and look for %00, %01 or @. Its January bulletins, on the 13th, brought no fix. By the working group's count the bug was used in 7.8 per cent of the phishing attacks reported to it that January, a month in which Citibank, the second most impersonated brand, kept a page warning its customers of fraudulent mail.
Microsoft's answer was to take the form away. By 29 January it had said that Internet Explorer would stop accepting user names and passwords in web addresses, and on Monday 2 February 2004, eight days before its next scheduled release, it issued MS04-004, a cumulative update rated critical. The browser now parsed the special characters so that the address bar showed the true host, and an address of the form http://username:password@server brought up an “Invalid syntax error” page, in Internet Explorer and in Windows Explorer. Passwords users had asked it to remember had to be typed again, and some secure sites returned errors until a further update. Other protocols were untouched and administrators could switch the old behaviour back on; the status bar, CERT/CC noted, still showed the truncated address.
Rooted Since November
On Monday 1 December 2003 the Free Software Foundation found that Savannah, the system it maintained to provide CVS and development services to GNU and other free-software projects, had been compromised: on or about 2 November an intruder had gained root access and installed a rootkit, SucKIT. The attacker seemed to have operated exactly as in the intrusion into Debian's servers that November tells, the foundation said. On 2 December a donated server in Gentoo's rsync.gentoo.org rotation was compromised for about an hour, during which some 20 users synchronised with it; intrusion detection and integrity checks left Gentoo reasonably confident its Portage tree was untouched, and on 4 December, as rsync 2.5.7 closed a heap overflow, it said an exploit for that flaw may have been used with the kernel's do_brk() bug. Savannah came back only piecemeal, on replacement hardware that the foundation's own staff reinstalled; passwords were reset and projects were asked to check their code against copies they trusted.
The Last Five Digits
At 11 a.m. on Thursday 4 December 2003, in the Roosevelt Room of the White House, President George W. Bush signed the Fair and Accurate Credit Transactions Act, FACTA, saying a growing number of Americans were victimised by criminals who assumed their identities. Every consumer was to be entitled to a free credit report a year from each of the three nationwide bureaus; one call would set a fraud alert running at all three, for at least 90 days or, extended, seven years; and regulators were to list the “red flag” indicators of identity theft on which lenders would have to act. Receipts were to show no more than the last five digits of a card number, and no expiry date: slips of paper most people threw away, the President said, “should not hold the key to their savings and financial secrets”. Older machines had three years to comply. The red-flag rules were issued only on 31 October 2007, and printed expiry dates brought a wave of lawsuits until Congress, in 2008, shielded merchants who had otherwise complied. Twelve days after FACTA came the CAN-SPAM Act, which January 2004 tells.
Beyond Declarations
The United Nations' World Summit on the Information Society met in Geneva from 10 to 12 December 2003, with delegates from 175 countries. On the 11th Arun Shourie, India's Minister for Communications, Information Technology and Disinvestment, asked it to go beyond declarations and commit to a few concrete programmes — against illiteracy, for machine translation between languages, for the print-disabled, for wireless signals that travel further — whose results could be reported at its second phase, in Tunis. India, he said, earned around $11 billion a year from exports of IT services and products and was adding 1.3 million mobile subscribers a month, and it offered to share its experience in e-governance, tele-medicine, literacy, information security and language technologies. He urged the working group the summit was about to request to examine internet governance more widely: power grids, financial systems and traffic control were growing progressively integrated, he said, information technology could be used to disrupt them, and all nations together had to devise ways to “prevent terrorists and other adversaries from doing so”.
The Declaration of Principles adopted on 12 December called a stronger framework of trust, information and network security included, a prerequisite for the information society, asked for a global culture of cyber-security and called spam “a significant and growing problem”. On who should manage the internet the summit could not agree. It declared that international management “should be multilateral, transparent and democratic” and asked the UN Secretary-General to set up a working group to make proposals by 2005. India's computer emergency response team was formally set up the next month, as January 2004 records; the summit's second phase, in Tunis, is November 2005's to tell.
Reinforcement learning flies a helicopter; QRIO runs
The Neural Information Processing Systems conference met from 8 to 13 December 2003 in Vancouver and, for its workshops, Whistler; its proceedings held 198 papers. In one, Andrew Ng of Stanford, with H. Jin Kim, Michael I. Jordan and Shankar Sastry of Berkeley, modelled a Yamaha R-50 helicopter's dynamics from several minutes of piloted flight, then used reinforcement learning on the model to train a controller that hovered more steadily than a Yamaha-licensed pilot and flew three manoeuvres from the hardest class of the Academy of Model Aeronautics' competition “fairly accurately”, in the authors' words. Ben Taskar, Carlos Guestrin and Daphne Koller of Stanford gave Markov networks, which capture correlations between labels, the margins of support vector machines. On 18 December in Tokyo Sony showed QRIO running at about 14 metres a minute, both feet leaving the floor for hundredths of a second, and called it the first humanoid to run while carrying its own controls and power. Sony had no plans to sell it, and stopped developing it in January 2006.
Check Point agrees to buy Zone Labs
On Monday 15 December 2003 Check Point Software Technologies, whose firewalls guarded corporate networks, agreed to buy Zone Labs, whose ZoneAlarm guarded individual PCs, for $205 million, about $113 million in cash and $92 million in shares. Zone Labs said its products protected more than 25 million internet users and more than 1,100 enterprise customers; its Integrity software checked desktops' patches and anti-virus signatures against policy and, working with network equipment, could quarantine machines that failed. Gil Shwed, Check Point's chief executive, said Zone Labs would run as a division under its own brand, and the free ZoneAlarm was to stay. Days later Microsoft released the first beta of Windows XP Service Pack 2, which switched XP's own firewall on by default. On 18 December Microsoft and New York's attorney general, Eliot Spitzer, sued OptInRealBig.com, a Colorado email marketer, and associated companies, citing more than 8,700 messages caught by Hotmail accounts set up as traps; its president said it would fight. The Zone Labs purchase closed in March 2004, and SP2 shipped in August 2004.
⏳ Time capsule — December 2003
- On 7 December Grayson Perry, best known for classically shaped ceramic vases covered with figures, patterns and text, was named the surprise winner of the £20,000 Turner Prize at Tate Britain, where Sir Peter Blake presented it.
- On 17 December, a hundred years after the Wright brothers' first powered flight, a reproduction of their Flyer built by Ken Hyde's Wright Experience could not fly at the foot of Kill Devil Hill, where Kevin Kochersberger tried at 10:35 in rain and weak winds; the same day Brian Binnie took SpaceShipOne to Mach 1.2 on its first rocket-powered flight, the first privately built craft to fly faster than sound.
- On 17 December Linus Torvalds released version 2.6.0 of the Linux kernel, its first new stable series since 2.4.0 of 4 January 2001; the 2.6 numbering lasted until version 3.0, on 21 July 2011.
- On 23 December the United States found its first known case of bovine spongiform encephalopathy, mad cow disease, in a cow from a dairy herd in Washington's Yakima Valley, later confirmed to have come from Canada; Japan halted imports of American beef, and sixty-five nations restricted them in full or in part.
What the Address Bar Shows
Internet Explorer refused user names and passwords in web addresses, by default, for the rest of its life, but the address bar remained where phishing was fought. One Cyrillic letter passed a false PayPal address for the real one in February 2005; Internet Explorer 7 put a yellow warning beside it in October 2006; and a genuine padlock stood over a skimmed British Airways payment page in September 2018. Phishers became defendants, from a Houston man jailed in May 2004 to the hundred charged in two countries in October 2009. Microsoft's advice of December 2003, to type an address rather than click it, is still on its support site in 2026, archived beneath a warning that Internet Explorer 11 has been permanently disabled on certain versions of Windows 10.
The month's other threads ran on. Rsync, the suspected way in at Gentoo, was the conveyor in August 2009, when Apache's rsync jobs carried scripts that intruders had planted, through an account used for backups, to its production web servers. Developers' credentials, which Savannah reset wholesale in 2003, became a worm's fuel in September 2025, when Shai-Hulud stole secrets from developers' machines and pipelines and used them to publish itself into more npm packages. Microsoft's monthly schedule went on bending whenever attackers would not wait for it, as October tells.