The first copies were reported on Thursday 5 June 2003, in the United States, Britain and Australia. Bugbear.B was a revision of a worm first seen on 30 September 2002, and it travelled two ways: by email, with shifting subject lines and attachments ending in .exe, .pif or .scr, and through open network shares. Where Internet Explorer 5.01 or 5.5 had not been patched, it could start as a message was merely previewed, through a flaw Microsoft had fixed in March 2001, MS01-020. It infected programs such as Notepad and Regedit, changing its shape as it went, tried to shut down anti-virus software and firewalls, logged keystrokes and waited for commands on TCP port 1080. Shared printers it tried to infect printed pages of junk.
It also sent out what it found. Its message bodies and attachment names could carry fragments of files from the victim's own disk, and by MSNBC's account it attached random Office documents from infected machines. At Stanford University, which said in a notice on its website that it had been badly hit, administrators shut off outgoing email for more than 35,000 users for part of Thursday 5 June; according to the notice, they had intercepted messages carrying salary and bonus spreadsheets and other confidential documents. MessageLabs, which filtered companies' mail, found the worm in 115 countries within hours and stopped 75,000 copies that Thursday, by the end of which one message in every 171 it scanned was carrying it. By the following Tuesday it had trapped 277,000.
Inside was a list of domain names, most of them banks' — more than 1,300 by Symantec's count, roughly 1,200 in the reports from Washington. J.P. Morgan Chase, American Express, Wachovia, Bank of America and Citibank were on it, with others from Spain and Iceland to Korea and South Africa. Hong Kong's Monetary Authority warned its banks on 6 June that some of the names belonged to banks there; the territory's emergency response team read them as meant for forging email. Symantec and Panda found more: the worm compared the infected machine's default email address with the list and, on a match, switched on automatic dialling and mailed out its cached dial-up passwords, in Panda's description. It was looking for computers inside banks, not for visits to them.
The FBI opened an investigation on Friday 6 June, though its spokesman, Bill Murray, cautioned that the mailboxes the worm reported to were no sure lead, since they might be blind drops. Suzanne Gorman, chairman of the banks' Financial Services Information Sharing and Analysis Center, said the worm had been battering at banks' outside servers and being turned away; on Monday 9 June industry executives told Treasury officials they were unaffected, and investigators knew of no institution significantly hit. By the end of June Bugbear.B accounted for almost 12 per cent of the enquiries Sophos had received all year, more than Sobig.C, which, like the D and E versions of 18 and 25 June, was set to stop spreading within weeks. Even after August's worms, Sophos ranked it eighth for 2003.
Sixty People
On Friday 6 June 2003 the Department of Homeland Security set up a National Cyber Security Division, working from that day, with about sixty people. It sat in the Information Analysis and Infrastructure Protection directorate and answered to Robert Liscouski, assistant secretary for infrastructure protection. It was to find and reduce weaknesses in the government's own systems, working with the private sector to protect critical ones; to run a consolidated Cyber Security Tracking, Analysis and Response Center, which watched for internet events and tracked threats; and to build awareness and education programmes, with analysis, alerts and warnings round the clock. The White House had had its own cyber-security adviser until April, and the division did not report directly to the secretary, Tom Ridge. Some in the industry, among them William Harrod of TruSecure, said that lowered the post's visibility within the administration. Alan Paller of the SANS Institute expected it to have the resources the White House's first adviser, Richard Clarke, had lacked, when he could do little more than persuade. A spokesman said the department was now actively looking for a director; Amit Yoran took the post that September.
At All Times
On Wednesday 18 June 2003 the Federal Trade Commission announced a settlement with Guess?, the clothing company, whose website had told shoppers that their personal information, card numbers included, was “stored in an unreadable, encrypted format at all times”. The commission alleged that since at least October 2000 guess.com had been open to commonly known attacks such as SQL injection, and that in February 2002 a visitor using one had read card numbers from its databases in clear text. A 20-year-old programmer had found the hole and estimated more than 200,000 customer records; after a week of trying to get it fixed he went to SecurityFocus, and a reporter's call had it closed within hours. Guess, which paid no fine and admitted nothing, said no consumer had been harmed; its spokeswoman conceded that an unencrypted copy had been kept for financial purposes. The order, final on 5 August, barred misleading security claims for twenty years and required a security programme, certified by an independent professional within a year and every other year after. It was the commission's third such case, after Eli Lilly's and Microsoft's over Passport (May).
Operational in July
In mid-June 2003 the BBC reported from Bangalore that India's first internet security centre was due to become operational in July. The Information Technology Secretary, Rajiv Ratan Shah, had given the date there. The centre was meant to prevent cyber attacks on key defence, business and government establishments, and the IT ministry was building it with help from CERT, the American centre run by Carnegie Mellon University. The main centre, in Delhi, was expected to cost up to $20 million; a second was planned at the Indian Institute of Science in Bangalore.
Addressing a conference organised by Nasscom, the software industry's association, Shah also said the government would bring Parliament a bill to protect data and address the security concerns of Indian and foreign companies alike, and that a draft was ready, meant to give overseas customers the confidence to outsource work to India. We found no record of what that draft contained. The centre's formal founding as CERT-In waited until January 2004, and by October the government was reported to be leaning towards amending the Information Technology Act instead of passing a data law (October 2003).
Learning object categories from cluttered pictures
The best-paper award at CVPR, the computer-vision conference held in Madison, Wisconsin, from 16 to 22 June 2003, went to Rob Fergus and Andrew Zisserman of Oxford and Pietro Perona of Caltech for a method that learnt object categories from cluttered pictures in which nobody had marked where the object was. Each category became a flexible constellation of parts whose shape, appearance, occlusion and relative scale were all modelled as probabilities. In tests on motorbikes, aeroplanes, faces, cars and spotted cats, the motorbike model found the wheels and fuel tank for itself, while the cat model settled for patches of spotted fur; fitting a model to 400 pictures took a day or more. The same month Neural Computation carried Laplacian eigenmaps, Mikhail Belkin and Partha Niyogi's way of finding low-dimensional shape in high-dimensional data, and planning researchers met in Trento for the first ICAPS, formed by merging two older conferences. Ten years on, the Madison paper won the Longuet-Higgins Prize, for decade-old CVPR papers of lasting impact.
Microsoft buys an anti-virus engine in Bucharest
On Tuesday 10 June 2003 Microsoft agreed to buy the intellectual property and technology of GeCAD Software of Bucharest, maker of RAV AntiVirus since 1994, for an undisclosed sum. It would use GeCAD's expertise to strengthen Windows, support other vendors and build anti-virus offerings of its own, though it named no products, prices or dates; Mike Nash, its security vice-president, spoke, by Information Age's account, of delivering anti-virus services by subscription. RAV, sold mostly for Linux mail servers, was to be discontinued when the deal closed, with support only until customers' contracts ran out. Andreas Marx of the University of Magdeburg could not see why Microsoft had bought “a Linux company”; Microsoft said it had wanted the technology for its quality. BitDefender, made in Bucharest too, offered RAV's customers 60 per cent off its Linux products the next day. The engine resurfaced in the removal tool of January 2005 and became a core technology of Windows Live OneCare, the subscription suite that the free Security Essentials replaced in September 2009.
⏳ Time capsule — June 2003
- On 2 June a Soyuz-Fregat rocket launched Mars Express, the European Space Agency's first planetary mission, from Baikonur in Kazakhstan, carrying the British lander Beagle 2. Released on 19 December, the lander was never heard from; images from NASA's Mars Reconnaissance Orbiter found it on the surface, intact, in January 2015. The orbiter's mission has been extended to the end of 2026.
- On 14 and 15 June a Bentley Speed 8 driven by Tom Kristensen, Rinaldo Capello and Guy Smith won the 24 Hours of Le Mans, two laps ahead of the team's other car: Bentley's sixth victory there and its first since 1930.
- On 20 June Jimmy Wales set up the Wikimedia Foundation in St. Petersburg, Florida, a non-profit to fund Wikipedia and its sister wiki projects, which his company Bomis had hosted until then; the encyclopedia's domain names and other rights passed to the foundation.
- On 27 June the Federal Trade Commission opened the National Do Not Call Registry, online and, at first, by telephone in states west of the Mississippi, with the rest of the country able to call in from 7 July; the FTC, the FCC and the states began enforcing it on 1 October.
Machines That Touch Money
No bank was reported to have lost anything to Bugbear.B's list, but the idea in it lasted: malware that works out where it has landed and saves its effort for machines that touch money. In March 2005 police revealed that thieves with key-logged passwords had tried to move £220 million out of Sumitomo Mitsui's London office; in October 2010 police in Britain, the United States and Ukraine moved against the money mules of the Zeus banking trojan; and Carbanak's operators, Kaspersky reported in February 2015, watched banks' own staff for months before cashing out. At Bangladesh Bank, in February 2016, intruders sent payment orders through the bank's own SWIFT terminal while their malware kept silent the printer that turned its messages into paper — where Bugbear's printers had spewed junk.
The month's other threads ran on as well. Two years after Guess, settling with BJ's Wholesale Club in June 2005, the FTC called weak security itself an unfair practice, and in January 2006 ChoicePoint agreed to pay a $10 million civil penalty, then the largest in the commission's history. Amit Yoran resigned from the Homeland Security division in September 2004; US-CERT, the readiness team it had set up, kept its name until the Cybersecurity and Infrastructure Security Agency, created by statute in November 2018, retired it in 2023. Sobig reached its sixth version in August. The worm's author has, on every record we found, never been identified.