On Monday 17 February 2003 Visa and MasterCard said that more than five million of their card accounts had been reached through a computer intrusion — not in their own systems but at a third-party processor that handled card payments for merchants. They said they could not name the processor, or say when or how the breach had happened. MasterCard, told by the processor, had begun warning the banks that issued its cards in the week of 3 February; it counted more than two million of its own accounts, Visa about 3.4 million. A Visa spokesman said the accounts were not concentrated in one region but spread across the country, and could belong to any bank. No cardholder, both associations said, would be liable for fraudulent charges.
Within two days the estimate, the card companies' and the Secret Service's, had grown to as many as 8 million account numbers, American Express and Discover cards among them, and on 19 February a report in CardLine named the processor: Data Processors International of Omaha, Nebraska, which handled transactions for catalogue companies, direct marketers and the businesses behind television advertisements asking viewers to order by phone. It had 40 employees, took up half the first floor of a three-storey building and was a subsidiary of TransFirst, a processor in Dallas. DPI said that Wednesday that an outsider without authorisation had got into its system, that it had immediately notified the card companies and law enforcement, and that it was sharing all it knew with the Secret Service and the FBI.
Some banks had acted before the public knew. Citizens Bank, warned by MasterCard's fraud unit, shut down some 8,800 MasterCard debit cards on Friday 14 February; PNC, Pittsburgh's largest bank, cancelled about 16,000 Visa-branded ATM and debit cards on 19 February, reissuing every one. In Honolulu, Central Pacific Bank sent out 130 new cards, and the director of the Honolulu Police Federal Credit Union, which also reissued cards, said about 54 of its accounts had been compromised, the director's own among them. DPI said the data reached held nothing that could tie a card number to a person — no names, addresses or Social Security numbers — and that it was unclear whether anything usable had been taken at all. Gartner's Avivah Litan noted that names and addresses could still be found through skip-trace databases.
How or when the intruder got in, DPI never said; it would not discuss the technical side, and one security executive, struck by the volume, bet on an insider, against DPI's own account. Visa already had a dozen security requirements for those handling its cards' data, from firewalls and patching to encryption, access control and a security policy, and failing them could bring a fine, restrictions or a permanent ban. Visa's and MasterCard's own counts came to about 5.6 million; the larger figure was an estimate. Analysts called it the largest single theft of credit-card data online to that date. In March DPI's spokesman said that no misuse had been reported. The Secret Service and the FBI investigated; we found no record that anyone was ever charged.
Encouraged to Consider
On Friday 14 February 2003 the White House released the final National Strategy to Secure Cyberspace. The President's Critical Infrastructure Protection Board had put a draft online the previous September and ten town-hall meetings had been held; critics had called the draft too lenient. The final text set five priorities — a national response system, threat and vulnerability reduction, awareness and training, securing governments' own systems, and international cooperation — and 47 numbered actions and recommendations. Its verbs divided the work: the Department of Homeland Security and federal agencies “will”; corporations and the software industry were “encouraged to consider”; home users and small businesses could help by installing firewalls, keeping anti-virus software current and applying updates. It said “federal regulation will not become a primary means of securing cyberspace” and that “the market itself is expected to provide the major impetus to improve cybersecurity.” The board did not outlast the month. Richard Clarke, its chairman, had announced his resignation at the end of January, and an executive order of 28 February dissolved the board and his adviser's post, sending its operational work to Homeland Security.
The Timing of an Error
On Wednesday 19 February 2003 the OpenSSL project published an advisory headed “Timing-based attacks on SSL/TLS with CBC encryption”. Brice Canvel, Serge Vaudenay and Martin Vuagnoux of EPFL in Lausanne, with Alain Hiltgen of UBS, had extended an attack Vaudenay had presented at Eurocrypt in 2002, which read the errors reported when checking the padding on messages encrypted in CBC mode. Against SSL and TLS that attack had failed: the errors were encrypted, and a session ended at the first one. The new attack listened to time instead. OpenSSL skipped checking a record's MAC when its padding was wrong, so a bad guess drew a quicker answer. It needed an attacker able to tamper with the traffic and a client sending the same secret again and again, as a mail program such as Outlook Express did each time it checked for mail. An attacker not too far from the server, the researchers wrote, could intercept an IMAP password in less than an hour in a typical setting. A card number, sent once, had little to fear. OpenSSL 0.9.6i and 0.9.7a computed the MAC whatever the padding.
Updating Billing Data
On 6 February 2003 it was reported that a city court in Delhi had convicted a 24-year-old engineer, in what was described as the first conviction in India for a cyber crime. In May 2002 an American cardholder with a billing problem had called the call centre in Noida where he worked. He took the call and, on the pretext of updating her billing data, talked her into revealing the key details of her card, which he then used to buy online. Later accounts, which know it as the Sony Sambandh case after the Sony site for non-resident Indians that he used, say he ordered a colour television and cordless headphones for delivery to Noida; about six weeks later the card company told the seller that the cardholder had disowned the purchase, and the seller went to the Central Bureau of Investigation.
Metropolitan Magistrate Gulshan Kumar convicted him of cheating under the Indian Penal Code, not the Information Technology Act of 2000, and did not send him to jail: he furnished a personal bond of Rs 20,000 and was released on a year's probation. A later case note speaks of a year's simple imprisonment; the report of February 2003 says otherwise. What is regarded as the first conviction under the IT Act itself came from a Chennai magistrate in November 2004, and the route through a call centre to other people's money opened again in Pune in April 2005, when former employees of a centre run for Citibank were among those accused over customers' PINs. A procedure for blocking websites, notified that month, is told in July 2006.
Kasparov and Deep Junior draw; words become vectors
On Friday 7 February 2003, in New York, Garry Kasparov offered Deep Junior a draw in the last of six games; its team declined but agreed a few moves later, and the FIDE-sanctioned match, begun on 26 January, ended 3–3. Kasparov had won the first game; the program, written by the Israelis Amir Ban and Shay Bushinsky, took the third after his blunder. More lasting was a paper dated February in the Journal of Machine Learning Research: Yoshua Bengio and three Université de Montréal colleagues had a neural network learn a vector of features for each word along with the probability of the next, so that, having read of a cat walking in a bedroom, it should find a dog running in a room almost as likely. It predicted unseen text better than the best n-gram models, by about 24 per cent in perplexity on the Brown corpus and 8 per cent on Associated Press news. Scaled up enormously, word vectors and next-word prediction became the core of today's large language models.
Gator settles with publishers; Symantec counts flaws
On Tuesday 4 February 2003 Gator settled the suit brought by some of the largest American news publishers, among them the owners of The New York Times and The Washington Post. Its software, bundled with a free utility for filling in forms, laid pop-up advertisements, chosen from users' browsing, over other companies' pages, the publishers' included, and in July 2002 Judge Claude Hilton had ordered it to stop doing so on their sites; Gator maintained its pop-ups were no different from other programs' windows. The terms stayed confidential, the publishers' lawyer saying it was settled “to our satisfaction”, and Gator, claiming 30 million users, still faced about a dozen other suits. Renamed Claria that October, it said in March 2006 that it would leave adware. That week Symantec's third Internet Security Threat Report counted 2,524 new vulnerabilities in 2002, up 81.5 per cent on 2001, and traced nearly 80 per cent of the malicious code sent to it in six months to Klez, Bugbear and Opaserv.
⏳ Time capsule — February 2003
- On 14 February Dolly the sheep, born on 5 July 1996 and cloned by associates of the Roslin Institute in Scotland, was put down at the age of six because of a progressive lung disease and severe arthritis; her preserved body is on display at the National Museum of Scotland in Edinburgh.
- On 17 February London began charging drivers £5 a day to enter a central zone covering roughly the area within the Inner Ring Road, the City and the West End included, enforced chiefly by cameras that read number plates; Ken Livingstone, the mayor, had been its leading proponent.
- On 17 February Google acquired Pyra Labs, the company behind Blogger, a weblog service open to the public since August 1999, for an undisclosed sum.
- On 27 February Fred Rogers, who made 895 episodes of Mister Rogers' Neighborhood, broadcast nationally from 1968, died of stomach cancer at his home in Pittsburgh, aged 74.
The Middle of the Chain
Processors handle card payments on merchants' behalf, and Omaha was not the last time one became the way in. An intruder at CardSystems Solutions, in Tucson, exposed some 40 million accounts by MasterCard's count in June 2005, from records the processor should never have kept, and the indictment over Heartland Payment Systems, which disclosed its breach on 20 January 2009, counted more than 130 million card numbers across it and four other companies (August 2009). In between, the card brands brought Visa's security programme and their own into one Payment Card Industry Data Security Standard, dated 15 December 2004 (December 2004). The intruder at DPI was never named on any record we found.
The strategy's board was gone within a fortnight; its call for a national response system was taken up by US-CERT, set up that September (January 2004), and Howard Schmidt, Clarke's interim replacement, who left the White House in May 2003, returned as its cybersecurity coordinator in December 2009 (May 2009). A national strategy of March 2023 set out to “rebalance the responsibility to defend cyberspace” away from individuals and small businesses. The Lausanne attack entered the standard: TLS 1.1, in April 2006, required record processing time to be “essentially the same” whatever the padding. Padding oracles returned in ASP.NET (September 2010) and in POODLE (October 2014), and TLS 1.3, in August 2018, kept only authenticated-encryption ciphers.