In 2003 the Linux kernel's master source lived in BitKeeper, a proprietary version-control system BitMover let kernel developers use free. For those who would not or could not, BitMover exported every change into CVS on its server kernel.bkbits.net, each revision ending with a pointer back to its BitKeeper changeset. On Tuesday 4 November 2003, by that repository's own clock, three revisions of kernel/exit.c appeared without one, credited to davem, the account name of David Miller, maintainer of the kernel's networking code. The first, its log message empty, added two lines to wait4(), the call a program makes to wait for a child process to end; the next two, twenty minutes later, took 58 lines out and put them back, the second logged as a slip on the wrong file.
The lines read if ((options == (__WCLONE|__WALL)) && (current->uid = 0)) retval = -EINVAL; To an eye skimming the file it was error-checking: refuse, when root was the caller, a combination of flags no program had reason to pass. But the second test had one equals sign where C wants two. It did not ask whether the caller's user ID was 0, root's; it set it to 0. The assignment's value was zero, so the error never fired, the call carried on, and its caller came back as root. “Whoever did this knew what they were doing,” said Larry McVoy, BitMover's founder: they had had to find flags that were never passed together yet raised no error. “It's indistinguishable from an accidental bug,” said Ryan Russell, a security consultant.
It was caught because nobody trusted the copy. Each night, McVoy explained, BitMover exported its tree to CVS in-house, copied the files to kernel.bkbits.net, compared checksums of both copies and mailed a warning on any difference. On Wednesday 5 November exit.c differed. McVoy put the file back, told the kernel mailing list someone had changed the CVS tree directly — “not a big deal, we catch stuff like this” — and asked whoever had done it to step forward: “Dave swears up and down that it wasn't him.” He posted the diff on request, and within about two hours of his first message one reader had called the code odd and another had pointed to the single equals sign. “Good eyes,” McVoy wrote, “I missed that.”
No account we found said how the intruder got in; McVoy wrote that someone may have been trying to break in, and that the server would be reinstalled. Linus Torvalds found it “telling that it was the CVS tree and not the BK tree that somebody tried to corrupt”, and said it could not have reached a release: core-file patches mailed to him were read and had to be explained, and those merging through BitKeeper would not have used CVS. Kevin Poulsen's report held that a developer building on the CVS copy could have carried it in. McVoy promised signed changesets in BitKeeper. Nobody stepped forward. Revisiting the case in October 2013, Princeton's Ed Felten wrote: “we don't know who it was that made the attempt—and we probably never will.”
A Price on Two Worms
On Wednesday 5 November 2003, at the National Press Club in Washington, Brad Smith, Microsoft's general counsel, announced an Anti-Virus Reward Program, funded with $5 million to start, and its first two offers: $250,000 for information leading to the arrest and conviction of whoever released the original Blaster worm, MSBlast.A, which had been aimed at windowsupdate.com, and the same for whoever was responsible for Sobig, whose B and C versions sent mail that seemed to come from Microsoft. Officials of the FBI and the Secret Service joined him; Interpol's secretary general, Ronald K. Noble, spoke from Lyon. Residents of any country could claim, under their own country's laws; Microsoft would pay, and tips were to go to the police agencies, not to the company. Two people had been arrested over later Blaster variants (August), none over the first or over Sobig. “These are real crimes that hurt a lot of people,” Smith said. The money was there to tempt someone who knew the authors to talk. It did, though not for those two worms: in May 2004 people who knew Sasser's author asked Microsoft about its reward (May 2004).
Exactly the Same Problems
At 17:00 GMT on Wednesday 19 November 2003 someone logged into klecker, one of the Debian project's servers, with a developer's sniffed password. Eight minutes later the intruder had root, through an integer overflow in the kernel's brk() call, and had installed the SucKIT root-kit. The same password opened master, which ran the bug-tracking system; from master, a backup administrator's account opened murphy, which ran the mailing lists; the next evening a password sniffed on master reached gluck, the web and CVS server. Master's kernel had begun throwing errors, and its administrators were about to take it in for suspected hardware faults when murphy proved to be “experiencing exactly the same problems”; AIDE, a file-integrity checker, reported that /sbin/init had been replaced. Every developer account was shut at midnight, and on 21 November Debian announced: “The archive is not affected by this compromise!” Checksum lists gathered for weeks on machines the intruder had not reached, and developers' signed upload records, bore it out. Andrew Morton had added the missing check to brk() in September, its security implication unconsidered; the stable Linux 2.4.23 carried the fix from 28 November.
Assured by Rule
On Thursday 27 November 2003 the Gazette of India published four sets of rules under the Information Technology Act of 2000. One, the Information Technology (Other Standards) Rules, made under the section headed “Controller to act as repository”, told the Controller of Certifying Authorities, at the root of India's chain of digital signatures, to observe the Information Technology Security Guidelines and the security guidelines for certifying authorities, both already cited in the certifying authorities' rules of 2000, so that “the secrecy and security of the digital signatures are assured”. A second amended the certifying authorities' rules. The other two served the Cyber Regulations Appellate Tribunal, which the Act provided to hear appeals against orders of the Controller and of the Act's adjudicating officers: they gave it further powers of a civil court, and set out how its presiding officer could be investigated for misbehaviour or incapacity.
The rules were the easy part. The section on the repository has since been omitted from the Act, and the tribunal's bench came to stand empty: its chairperson's post fell vacant on 1 July 2011, when Justice Rajesh Tandon retired, and its technical member could not hear cases alone, because the Act required the chair. In September 2013 the Karnataka High Court recorded the government's undertaking to fill the post within six months; the Finance Act of 2017 gave the tribunal's jurisdiction to the Telecom Disputes Settlement and Appellate Tribunal. The chain the Controller kept was tested in July 2014, when certificates for Google's domains were issued without authority under the National Informatics Centre (May 2014).
Kasparov and X3D Fritz draw in virtual reality
From 11 to 18 November 2003 Garry Kasparov, the world's top-rated player, played four games in New York against X3D Fritz, a program running on four 2.8GHz Xeon processors, in a match billed as the first world chess championship in virtual reality. He touched no pieces: wearing 3D glasses, he watched a board that seemed to float in mid-air, turned it with a joystick and spoke his moves to speech-recognition software. The first game was drawn; in the second, short of time, he blundered on move 32 and lost; in the third the program's operators resigned on move 45; the fourth was drawn in 27 moves. The 2–2 draw added $25,000 to his $150,000 fee. The day before the match began, Carnegie Mellon inducted the first members of its Robot Hall of Fame: Unimate, the first industrial robot; NASA's Sojourner rover; R2-D2; and HAL 9000. Kasparov had forecast that within five years it would be “impossible to beat a machine in long matches”; three years later Deep Fritz beat the world champion, Vladimir Kramnik, 4–2.
Diebold puts Sygate's firewall in its ATMs
On Wednesday 19 November 2003 Diebold said it was teaming with Sygate Technologies: from December every new Diebold ATM would ship with the Sygate Security Agent, built on Sygate's personal firewall, and Windows machines already in the field could be upgraded. Six days later SecurityFocus reported one reason why. By Diebold's account Welchia, the clean-up worm of August, had that month reached ATMs running Windows XP Embedded at two financial institutions it would not name, in what the report called the first confirmed case of malicious code in cash machines. The infected machines, scanning for others, tripped the banks' intrusion detection and were cut off, many cleaned up the same day. Microsoft's patch had not been applied, though Diebold said it had adapted and offered it to customers. Chuck Somers, a Diebold vice-president, said customers “placing ATMs on their network” had brought requirements it had never had to meet. Symantec agreed to buy Sygate in August 2005, and when Windows XP's patches stopped in April 2014 many of India's cash machines still ran it.
⏳ Time capsule — November 2003
- On 12 November, on a test run, a train on the Shanghai maglev line, which links Longyang Road in Pudong with Pudong International Airport and whose train sets were built by a joint venture of Siemens and ThyssenKrupp, reached 501 km/h, a Chinese record.
- On 17 November Let It Be... Naked was released: the Beatles' 1970 album Let It Be, remixed at Paul McCartney's instigation without most of Phil Spector's orchestral embellishments or the studio chatter, with “Dig It” and “Maggie Mae” dropped and “Don't Let Me Down” added. George Harrison had approved the project before his death.
- On 22 November, at Stadium Australia in Sydney, Jonny Wilkinson dropped a goal with his right foot with 28 seconds of extra time left, and England beat Australia 20–17 to win the Rugby World Cup before a crowd of 82,957.
- On 28 November Kal Ho Naa Ho opened, set in New York, with Shah Rukh Khan, Saif Ali Khan and Preity Zinta: Nikhil Advani's first film as director, from a story by Karan Johar, and the last produced by Yash Johar, who died in June 2004. Its overseas earnings were the highest of any Indian film that year.
Compare the Copies
BitKeeper held the kernel for seventeen more months. In April 2005 BitMover withdrew its free licence, McVoy claiming that Andrew Tridgell had reverse-engineered its protocols, and Torvalds wrote Git to criteria that took CVS as an example of what not to do and asked for strong safeguards against corruption, accidental or malicious. When intruders were found with root on a kernel.org server in 2011 (September 2011), its administrators believed the git repositories untouched and set about proving it. Comparing copies went on catching single lines: one customer's checksum exposed the line added to Codecov's script in April 2021. The back door found in XZ Utils in March 2024 came from inside, through an account that had spent years earning a maintainer's trust, and was caught by half a second.
Debian's archive was proved clean by records its intruder could not reach; the damage it did later was its own, a change to its OpenSSL package that, disclosed in May 2008, had made twenty months of its keys guessable. The brk() flaw had been fixed before anyone saw what it meant, and was exploited in the gap; Debian's report of 2 December said the person had “not yet been uncovered”, and we found no sign that anyone ever was. Microsoft's fund paid for Sasser, to two acquaintances from its author's school (July 2005); its $250,000 over Conficker (February 2009) has no payment on record, and its offer over Rustock (July 2011) drew tips but no conviction. No one has been charged over Sobig or the first Blaster, on every record we found.