Russ Cooper of TruSecure, a security company in Herndon, Virginia, described it as a web server of no use to anyone, doing nothing at all: by his account a publicly reachable machine running Microsoft's IIS 5.0 on Windows 2000, managed by the US Army but no part of its websites, and holding nothing sensitive. On Monday 10 March 2003, by TruSecure's account, someone sent it a specially formatted request and took complete control. The intrusion went unnoticed until Army staff saw the server scanning: it was mapping the network around it and sending the results, again and again, to one destination over port 3389, the port Windows Terminal Services uses. A file the intruder left behind, Army sources said, welcomed its reader to a Unicorn beachhead.
The Army rebuilt the server, and the attack worked again almost at once. Army staff, Cooper said, did not know it was a new vulnerability; they knew only that IIS was patched and the attack still worked. The hole lay beneath IIS, in ntdll.dll, a core Windows library. WebDAV, an HTTP extension for editing files on a web server, was on by default in IIS 5.0, which ran by default on every Windows 2000 server product; it passed requested paths to a routine in ntdll.dll that could handle no more than 65,535 bytes, and a longer one overflowed it, running the attacker's code with the machine's highest privileges. An Army source told Cooper on 11 March. By CNET's later account, the attack was Microsoft's first notice of the flaw.
Microsoft published MS03-007 on Monday 17 March, rated critical; it knew, it said, of a publicly available exploit already in use against Windows 2000 servers running IIS 5.0. Steve Lipner, its director of security assurance, told MSNBC that attacks reported through a hole with no patch were very unusual; about 100 employees had worked around the clock on the fix, he said. Cooper's account was less flattering: the Army had reportedly filed a bug report online instead of going to senior Microsoft managers, and when he called Microsoft, he said, none of the people he spoke to knew, and they should have. The Army disputed the premise: Colonel Ted Dmuchowski, its director of information assurance at Network Enterprise Technology Command, said the military sites attacked had not belonged to the Army.
The fix needed fixing. On 18 March Microsoft warned that Windows 2000 machines on Service Pack 2 carrying any of twelve hotfixes issued only through its support line would halt at the first reboot. On Monday 24 March a Venezuelan security consultant posted exploit code to the BugTraq list, saying he had tested it himself. The flaw ran wider than WebDAV: Microsoft patched Windows NT 4.0 on 23 April and XP on 28 May, after a researcher reported it there; Stephen Toulouse of the Microsoft Security Response Center said the Windows 2000 fix had taken less than a week. On 18 August Microsoft warned that a worm, Nachi, was using the hole against IIS 5.0 (August 2003). On every record we found, nobody was charged with the intrusion.
Quiet Until Patched
On Monday 3 March 2003 alerts went out from the Federal Computer Incident Response Center and the industry information-sharing centres, and Internet Security Systems published what its researcher Mark Dowd had found. Every version of Sendmail from 5.79 to 8.12.7 had a buffer overflow in crackaddr(), the routine that evaluated address fields, and could hand a remote attacker root; Sendmail, ISS noted, had been documented as handling between 50 and 75 per cent of the internet's email. The attack rode inside a message, so firewalls would carry it to mail servers deep inside a network, and on an unpatched machine it left no log entry. ISS had found the flaw on 1 December 2002, Computerworld reported, and told homeland security officials on 5 December; vendors heard on 13 January, and military organisations had early patches on 25 and 26 February. Sendmail told CERT/CC it had exploited the flaw in a laboratory. On 29 March CERT/CC announced a second, in the code that parsed addresses, found by Michal Zalewski; a third, also his, followed on 17 September.
Six Numbers a Second
On Sunday 2 March 2003 staff at the University of Texas at Austin, looking into a malfunctioning computer, found it had been attacked from the internet. Several times in late February and early March, by the university's account, a program had fed a database possible Social Security numbers by the hundreds of thousands and kept whatever matched: names, email and departmental addresses, titles and telephone numbers for about 55,200 students, staff and job applicants, past and present. The database, TXClass, tracked staff training, and its users logged in with their Social Security numbers. On 14 March prosecutors charged Christopher Andrew Phillips, a 20-year-old undergraduate, who surrendered and told investigators he had not meant to pass the numbers on. His program, the appeals court later found, tried up to six numbers a second and crashed the university's systems several times. A jury later convicted him of computer fraud and of possessing stolen Social Security numbers, a count the district court dismissed because the law had been amended only after his last act; five years' probation, 500 hours of community service and $170,056 in restitution followed, upheld by the appeals court in January 2007. Other universities' databases of Social Security numbers were broken into at George Mason (January 2005) and UCLA (December 2006).
A Few More Months
On Monday 24 March 2003 the computer supplement of The Tribune, in Chandigarh, asked what India's call centres were doing with the card numbers they heard. Its prompt was the Delhi conviction of a call-centre engineer in Noida (February 2003). The IT Act, said Pavan Duggal, a Supreme Court lawyer, was not adequate to deal with compromised data: “India does not have any law on data protection.” Nasscom called it too early to read much into an isolated case, and said legislation it was preparing with the IT ministry would take a few more months.
A second article in the issue listed what the Information Technology Act, 2000 left out. Roop Loomba found it “conspicuously silent” on intellectual property, domain names included, and said it covered neither credit-card fraud nor spamming, cyber-stalking or email spoofing, all of which had to be prosecuted under the Penal Code; its confidentiality clause, Section 72, “needs to be made airtight”. Parliament amended the Act in December 2008, and the data protection law Nasscom had expected within months arrived twenty years later, as the Digital Personal Data Protection Act of August 2023. The Tribune's question came back sooner: a British newspaper said in June 2005 that it had bought a thousand bank customers' records from a worker in Delhi.
Face recognition, graded on visa photographs
On 13 March 2003 the National Institute of Standards and Technology published the Face Recognition Vendor Test 2002, run with DARPA at a naval base in Virginia the previous summer. Ten companies took part, and the main test used 121,589 photographs of 37,437 people from the State Department's Mexican visa archive. Indoors the best, from Cognitec and Identix, confirmed nine genuine claims in ten while admitting one impostor in a hundred, and errors had halved since 2000; outdoors the best managed only half. Women proved harder to recognise than men, and the young than the old. Mozilla 1.3, released the same day, filtered junk mail by learning from the messages each user marked, on the Bayesian method of Paul Graham's essay A Plan for Spam. NIST kept testing: between 2014 and 2018, as convolutional neural networks swept the industry, face recognition grew twenty times better at searching a database for a match, yet in 2019 NIST found demographic differences in most algorithms, with more false matches for Asian and African American faces than for Caucasian ones.
Network Associates reopens its books
On 26 March 2003 Network Associates, best known for McAfee anti-virus software, said it would restate its results for 1998, 1999 and 2000 for the second time and postpone its annual report for 2002, due on 31 March. It cited information from the investigations of the Securities and Exchange Commission and the Justice Department; sales to distributors would count only once the software sold on, its practice since 2001. Of the Justice Department's inquiry, which the company had learned of that quarter, George Samenuk, the chief executive, said it would “not speculate on where it is headed”; the shares slipped. In June the SEC and federal prosecutors charged its former corporate controller; the restatement, filed on 31 October, reached back to 1997. In January 2006 the SEC alleged that the company had overstated revenue by $622 million between 1998 and 2000, partly by overselling to distributors and secretly paying them to hold the excess. McAfee, as it had become in June 2004, agreed to a $50 million civil penalty without admitting or denying the allegations.
⏳ Time capsule — March 2003
- On 6 March the SCO Group sued IBM for $1 billion, claiming that IBM had put SCO's intellectual property into Linux without permission, a suit whose end is told in January 2004.
- On 18 March Adam Osborne died in his sleep in Kodaikanal, in the hills of Tamil Nadu, aged 64. His Osborne 1 of 1981, 24.5 pounds and $1,795 with word-processing and spreadsheet software included, was the first commercially successful portable computer; he had returned to India in 1992 in declining health.
- On 23 March Australia beat India by 125 runs in the World Cup final at the Wanderers in Johannesburg. Ricky Ponting made 140 not out from 121 balls, with eight sixes, in a total of 359 for two; India were all out for 234.
- On 23 March, at the 75th Academy Awards at the Kodak Theatre in Hollywood, Chicago won six Oscars, among them best picture, the first musical to take it since Oliver! in 1968; Adrien Brody, 29, became the youngest best actor, for The Pianist.
Before the Patch
Security experts called the intrusion a rare example of a zero-day; in 2026 it reads as an early entry in a long ledger. Microsoft formalised a monthly patch day that October (October 2003), and a release outside the schedule became the mark of a flaw already in use: Exchange's four holes had been exploited since early January before Microsoft's emergency patches of 2 March 2021 (March 2021). The quarrel between TruSecure's account and the Army's, over whose server it had been and who knew what when, was never settled in public on any record we found, and the intruder who named the beachhead left no name of their own.
The month's last trick needed no software flaw. On Thursday 27 March 2003 visitors to aljazeera.net's English site began reaching a page with an American flag and the words “Let Freedom Ring”. John William Racine II, a 24-year-old web designer in Norco, California, had posed as Al Jazeera's systems administrator, faxed its registrar, Network Solutions, a forged photo ID and authorisation, and diverted the domain and about 300 of its emails; he pleaded guilty, and that November was sentenced to 1,000 hours of community service and a $2,000 fine. Comcast lost its name at the same registrar in May 2008, The New York Times at Melbourne IT in August 2013, and in January 2019 CISA's first emergency directive ordered agencies to lock down their registrar accounts.