Muhammad Faisal Rauf Danka, a self-described private security consultant in Karachi, went looking after Passport accounts belonging to him and a friend were, he said, hijacked again and again. He made certain that no one had broken into his own computer, then examined the Microsoft site that controlled Passport accounts, and by his account found the hole about four minutes after he began searching in earnest; his write-up dated the find to 12 April 2003. A page called emailpwdreset, which sent out the link for resetting a forgotten password, took its instructions from its own web address, including where that link should go. With a victim's account in one field and an attacker's mailbox in another, the link came to the attacker.
He had written to Microsoft, he said, more than ten times. Passport, closely tied to Windows XP, controlled access to Hotmail and to Microsoft's instant messaging, and dozens of retail sites used it to sign customers in. The details appeared online on Wednesday 7 May; late that night, more than an hour later, Microsoft shut the address down, and early on Thursday it set permanent filters in place. It acknowledged that the flaw had affected all 200 million Passport accounts. Adam Sohn, a product manager, put it down to input the page had never checked. The company knew of no account actually hijacked, he said; several experts said they had tested the method overnight. Danka, for his part, said the trick had been far simpler than it should ever have been.
Microsoft was answerable for more than a bug. On 8 August 2002 it had settled Federal Trade Commission charges that it misrepresented Passport's security, among them that it used “reasonable and appropriate measures under the circumstances” to protect the personal information collected through Passport, card numbers stored in its Wallet included. The final order, issued on 20 December 2002 to run for at least twenty years, required a written security programme, certified by an independent professional within a year and every two years after; each violation could bring a civil penalty of $11,000. On 8 May the commission said it was investigating. Jessica Rich, an assistant director, told the Associated Press that each vulnerable account could count as a separate violation; the AP did the sum: a theoretical $2.2 trillion.
Microsoft said it already had the security programme the order required. Gartner advised companies not to rely on Passport. On 1 July Microsoft said it had closed a second hole, in a small number of accounts more than four years old, after a self-described security consultant published it; the commission, the AP reported that day, had still not decided what sanctions and fines, if any, to assess over May's. We found no record that it ever acted. Passport never became the sign-in for web commerce it had been positioned as: two of the sites that had used it, eBay and Monster.com, dropped it within two years, and in 2012 its successor, Windows Live ID, was renamed the Microsoft account.
Waiting for Orders
Fizzer appeared on Thursday 8 May 2003, F-Secure said, and businesses in Asia were the first to report it. It travelled as an email attachment under random subject lines and as randomly named files in KaZaA's shared folder, and it was several programs in one: a keylogger; a bot that waited for orders in password-protected IRC channels and on AOL's messaging network; a web server; a flooding tool, of the kind with which, SCO said, 138 machines had knocked the SCO Group's website offline from late morning until 4 p.m. on 2 May, an attack MyDoom would repeat on a far larger scale; and a routine that killed anti-virus programs and fetched updates from a GeoCities page. Its bots nearly overwhelmed several IRC networks — Mysteria's server logged more than 40,000 different addresses within days — and the operators of more than 50 networks banded together; one group wrote a way to uninstall the worm from infected machines, and The Register asked whether that was legal. MessageLabs blocked Fizzer 497,846 times in May and ranked it first; Kaspersky's chart of registered incidents put it fourth, at under 1 per cent.
Not Just a Nuisance
On Tuesday 13 May 2003 Howard Carmack was taken into custody at his home in Buffalo, New York. About a week earlier a federal court in Atlanta had awarded EarthLink $16.4 million and a permanent injunction against him; he had not turned up. EarthLink said his operation had sent more than 825 million unsolicited emails since March 2002 from accounts bought with stolen credit cards and identities. Spam was not the charge. New York's attorney general, Eliot Spitzer, charged him with forgery, identity theft, falsifying business records and possessing a forgery device — software that faked return addresses — over EarthLink accounts opened in the names of two Buffalo-area residents. Spam in itself, Spitzer said, was not a crime; what made it criminal here was its meeting with forgery and identity theft. His was the first prosecution the attorney general brought under the state's identity-theft law, then about six months old, and Carmack stayed in jail, unable to post $20,000 bail. On Thursday 1 April 2004 an Erie County jury convicted him on fourteen counts, identity theft and forgery among them; on 27 May he was sentenced to three and a half to seven years.
Ten Sites in a Day
A Hindustan Times report, picked up by a security news digest on 2 June 2003, described a Pakistani group calling itself FBH defacing as many as ten Indian sites in a day; two of them, run by the Punjab government's Department of Information Technology, went offline. It counted 494 Indian sites hacked so far that year, 270 in the previous month alone, against 288 in the whole of 2002, without saying whose count it was. Defacement is the plainest of intrusions: the intruder replaces a site's pages with their own, signs them, and often leaves the site unreachable until it is restored. The report presented the surge as retaliation for a worm Indian hackers had aimed at Pakistani government sites (January 2003).
Nobody could say how many there really were. In January one consultant had estimated that Pakistani attackers were hacking or defacing 40 to 50 Indian sites a month, without saying how he had counted, a pace the report's figures put far behind. Nor was there yet a national team to take such reports; the date for one was set the next month (June 2003).
Phrase-based translation makes its case in Edmonton
The Human Language Technology conference and the North American chapter of the Association for Computational Linguistics, combined as an experiment, met at the Westin in Edmonton from 27 May to 1 June 2003; on 28 May the NAACL executive noted that Edmonton's remoteness, SARS and America's orange terror alert had kept numbers down somewhat. The paper that endured came from Philipp Koehn, Franz Josef Och and Daniel Marcu of the University of Southern California's Information Sciences Institute. Translating European Parliament proceedings, mostly from German, they found that phrase-based models beat word-based ones, that phrases longer than three words added little, and that the best results came by “relatively simple means”. Och moved to Google, whose statistical translator, built under him, went online in April 2006; a neural network that translated whole sentences, not stitched phrases, began replacing it in September 2016. At CoNLL, held alongside, sixteen systems sought the names of people, places and organisations in Reuters and Frankfurter Rundschau text; the best English F-score was 88.76, and BERT reached 92.8 on the same test in October 2018.
Calgary's virus course draws fire; Harvard maps Gator
On 23 May 2003 Sophos called a University of Calgary course in virus writing irresponsible. John Aycock's Computer Viruses and Malware, due that autumn, promised a focus on developing viruses, worms and Trojan horses; to the university's comparison with SARS research, Sophos replied that scientists did not create new biological viruses to find cures. On 28 May its joint chief executive, Jan Hruska, told virus writers not to bother applying. Two anti-virus information networks asked Calgary to reconsider; on 3 June Sophos and competitors signed a public letter calling virus writing neither necessary nor useful for defence. Calgary kept the course, promising locked, staffed laboratories off the internet and vetted students; Aycock later had students write spam and spyware too, and in 2006 knew of none who had misused the training. On 22 May CNET reported that Harvard's Ben Edelman, an expert for Gator's opponents in court, had queried its ad lists for thousands of sites, finding some targeted with rivals' pop-ups; Gator's Scott Eagle said he was “only touching a part of the elephant”.
⏳ Time capsule — May 2003
- On 3 May, between midnight and 2 a.m., the Old Man of the Mountain fell: five granite ledges on Cannon Mountain in Franconia, New Hampshire, that formed a face in profile when seen from the north, the state's emblem since 1945 and a fixture of its licence plates, road signs and quarter. Chains, then cement, steel rods and turnbuckles, had been used for decades to hold it together.
- On 5 May LinkedIn, a network for professional contacts founded the previous December in Mountain View, California, by Reid Hoffman and a team drawn from PayPal and Socialnet.com, was launched; it reached a million users in August 2004.
- On 15 May The Matrix Reloaded, which had premiered in Westwood, Los Angeles, on 7 May, opened around the world; for its freeway chase the producers had built a mile and a half of freeway on the old runways of Naval Air Station Alameda. It took $91.7 million in its opening weekend.
- On 22 May, at the Colonial in Fort Worth, Texas, Annika Sörenstam became the first woman to play in a PGA Tour event since Babe Zaharias in 1945. She opened with a 71, one over par; after two rounds she was five over, tied for 96th of the 111 who finished them, and missed the cut.
The Recovery Channel
The page Danka found was mended in a night; the route it opened, through recovery rather than the password, stayed in use. A student reset Sarah Palin's Yahoo password with answers found through Wikipedia and Google in September 2008; an intruder reached Twitter's documents through a lapsed Hotmail address and the reset link Gmail sent it in July 2009; support lines at Amazon and Apple gave a caller enough to take Mat Honan's accounts in August 2012; and in April 2019 intruders used Microsoft's own support tooling to look into Outlook.com, Hotmail and MSN accounts. Passport is now the Microsoft account, and the mailbox it guards remains, as this magazine's India desk tells small firms, the recovery channel for everything else.
The commission's arithmetic stayed theoretical: we found no complaint over Passport before the order reached its twenty years in December 2022. Other broken orders were billed: Twitter's came to $150 million in May 2022, for letting advertisers use phone numbers and addresses users had given to secure their accounts. Carmack was charged before there was any federal spam law; EarthLink was among the four providers that brought the first large suits under CAN-SPAM in March 2004. Fizzer's idea outlived it: a guilty plea in January 2006 described access to machines gathered in an IRC channel sold for attacks and spam, and the FBI's own count of hijacked machines passed a million in June 2007.