On Monday 15 September 2003 VeriSign, which ran the .com and .net registries under contracts with ICANN, added a wildcard record to both zones. Until then a query for a name that was not there — mistyped, lapsed, never registered, or registered but not in service — had drawn the answer that no such domain existed. Now it drew an address, 64.94.110.11, belonging to a VeriSign server. A browser that followed it reached Site Finder: a search box, a list of similar names it suggested instead, popular categories and paid advertising links. The Wall Street Journal and Computer Business Review had reported the plan earlier that month, but ICANN's Security and Stability Advisory Committee later found that the change had come abruptly and without broad notice.
Software that relied on the old answer misbehaved. Simple spam filters turned away mail whose sender's domain did not exist; now every invented domain existed, and at one large operator, the Internet Architecture Board was told, mail from such domains still made up about a tenth of inbound attempts. Mail to a mistyped address went to a VeriSign server called Snubby, whose flawed handling of the mail protocol left some senders retrying and others returning the message; should that server slow or fail, the IAB warned, such a slip might go unnoticed for days. On 20 September VeriSign replaced Snubby with a server that rejected each recipient as “no such user”, so who was mailing whom now reached its machines; it denied keeping the information. Connections of any other kind were refused.
In Tennessee, where one provider served 132 of the 139 public school districts and some 900,000 pupils, Site Finder opened a way round the schools' filters against objectionable sites, and help-desk calls rose. The administrators installed a patch that the Internet Software Consortium, maker of the BIND name-server software, had released on 17 September, letting name servers turn VeriSign's answer for .com and .net back into “no such domain”. On 19 September ICANN asked VeriSign to suspend the service voluntarily, and the IAB put the burden on any registry to show such a wildcard was safe. On 21 September VeriSign called suspension “premature”. Some 18,000 people signed a petition to ICANN.
On Friday 3 October ICANN's president, Paul Twomey, demanded that VeriSign restore the domains as they had been before 15 September by 6 p.m. Pacific time the next day, or ICANN would seek to enforce the contracts. VeriSign complied on Saturday 4 October, under protest, and at ICANN's hearings that month it cited a survey in which 76 per cent of respondents had rated Site Finder excellent or very good. In July 2004 the advisory committee found that the change had had no “network-shattering effects” but had violated fundamental architectural principles. VeriSign had sued ICANN in Los Angeles that February; a settlement, approved by ICANN's board nine votes to five on 28 February 2006, brought a new .com contract under which services like Site Finder needed ICANN's approval first.
The Cumulative Patch
From Thursday 18 September 2003, five weeks after Blaster, a worm that F-Secure named Swen and Sophos W32/Gibe-F mailed itself in Microsoft's name. From senders dressed up as Microsoft support or security departments, messages carrying a program of about 106 kilobytes offered a cumulative patch for September 2003 for Internet Explorer, said to fix three newly discovered vulnerabilities. Opened, the attachment showed an installer with Yes and No buttons and a progress bar, and installed itself whichever was pressed; on machines lacking a fix Microsoft had issued in March 2001, Internet Explorer could run it unopened. It shut down anti-virus and firewall programs, spread through Kazaa's shared folders, IRC channels and mapped network drives and, if it could not find the user's mail settings, raised a fake error asking for them. A web counter that each infected machine visited passed 510,000 by 20:00 GMT that day, which F-Secure did not take for a count of infections, believing the true number lower. Microsoft did not send patches by email. Variants found on 9 October swapped many of the worm's references to Microsoft for references to Tiscali.
Forced Out
On 24 September 2003 the Computer & Communications Industry Association, a trade group whose members included Microsoft's rivals, published CyberInsecurity: The Cost of Monopoly. Its seven authors — Dan Geer, chief technology officer of @stake, with Rebecca Bace, Peter Gutmann, Perry Metzger, Charles Pfleeger, John Quarterman and Bruce Schneier — argued that because most of the world's computers ran Microsoft's systems, most were open to the same worms at the same time, and proposed that no operating system hold more than half the installed base of a government or critical industry. On 25 September @stake, which counted Microsoft among its clients, said Geer had left its employ on the Tuesday, the day before the paper appeared, and that his views were not the company's. Microsoft denied any part in his dismissal, though its spokesman said @stake had contacted it late that Tuesday to express disappointment with the paper; @stake's spokeswoman said she knew of no such contact. “I was forced out,” Geer said. Schneier, one of his co-authors, wrote that no one had funded the paper, and that the association had distributed it without writing any of it.
Counting the Certified
On 15 September 2003 Computerworld asked what American companies moving IT work offshore were getting in security, and its main case was India, by then among the most popular destinations. A McKinsey and Nasscom study expected Indian IT services to earn $57 billion in 2008; applying an American rule of thumb, the magazine reckoned India should be spending $450 million to $600 million on information security by then — its own estimate, not a measurement. Wipro, the country's third-largest outsourcer, said its security consulting practice had 220 staff and was growing by about 70 per cent a year, that it had been the first company in the world certified to the 2002 version of the British security standard BS 7799, and that it had held Code Red and Slammer to less than 5 per cent of its systems. Those figures were Wipro's own.
One figure that anyone could check was smaller: by the magazine's count, India had 175 holders of the CISSP certification registered on the website of its issuer, ISC2, against 465 in China, about nine in ten of them in Hong Kong. Gartner's Rich Mogull advised companies to investigate their providers and to write vulnerability assessments and audits into their contracts, and Giga's Stephanie Moore thought the added operational risk would limit offshore infrastructure work for now. India had no data-protection law. The arrests that tested the offshore promise came in Pune in April 2005, when former call-centre workers were accused of taking money from Citibank customers' accounts, and liability for negligent security of sensitive personal data arrived, as Section 43A, in October 2009.
Congress shuts the Pentagon's data-mining office
On Wednesday 24 September 2003 House and Senate negotiators settling the Pentagon's budget voted to end funding for Terrorism Information Awareness, the DARPA programme, called Total Information Awareness until May, that was developing tools to search credit-card, medical, travel and other records for signs of terrorist planning. Their report directed that its parent, the Information Awareness Office, headed until August by John Poindexter, be “terminated immediately”, and named the only four of its research projects that might continue under DARPA, among them automated translation and analysis of speech and text in several languages. Earlier in the month, on 4 September, Sony announced the ERS-7, the third generation of its AIBO robot dog: priced at $1,599 in the United States, it understood close to 180 voice commands and used visual-pattern recognition to find its charging station when its battery ran low. On 30 September Google bought Kaltix, a three-month-old, three-person Stanford start-up working on personalised search.
Symantec buys PowerQuest; Sophos buys ActiveState
On Tuesday 23 September 2003 Symantec agreed to pay about $150 million in cash for PowerQuest, of Orem, Utah, whose software imaged and restored hard disks, to join it to its own Ghost in a line called Active State Management, with versions for servers, workstations, laptops and handheld devices. The purchase was completed in December; the merger with Veritas agreed in December 2004 would take Symantec far deeper into storage. The next day Sophos, which had already offered anti-spam through partners, ActiveState among them, bought that Vancouver company for $23 million in cash, said it would keep all of its hundred-plus staff, and set out to combine ActiveState's PureMessage filter with its own anti-virus engine; ActiveState's tools for programmers kept their own name, and its president, Steve Munford, became Sophos's chief executive in January 2006. Also on 23 September Governor Gray Davis signed a California law outlawing most commercial email that recipients had not asked for, with penalties of $1,000 a message, up to $1 million a campaign; the federal CAN-SPAM Act overrode it (January 2004).
⏳ Time capsule — September 2003
- On 12 September Johnny Cash died at Baptist Hospital in Nashville of complications from diabetes, aged 71, four months after June Carter Cash, his wife since 1968. The American Recordings series he had begun with the producer Rick Rubin in 1994 continued after his death, with albums in 2006 and 2010.
- On 17 September Richard Grasso resigned as chairman of the New York Stock Exchange after its board voted 13 to 7 for him to go, amid criticism of a pay package from which he had already received $139.5 million. Eliot Spitzer, New York's attorney general, sued in May 2004 to recover most of it; in June and July 2008 the state's appeals courts dismissed the claims against him, and the state did not appeal.
- On 21 September, at 18:57 UTC, NASA ended the Galileo mission by plunging the spacecraft into Jupiter, which it had orbited since December 1995, nearly fourteen years after the shuttle Atlantis launched it. Short of fuel, it was destroyed so that it could never contaminate any life there might be on the moon Europa.
- On 23 September AMD released the Athlon 64, codenamed ClawHammer and made on a 130-nanometre process: the first 64-bit x86 processor aimed at ordinary consumers, still able to run 32-bit x86 software. Intel released its Pentium 4 Extreme Edition the same week, and at first AMD could make only about 100,000 of the new chips a month.
After the Wildcard
Site Finder, on every record we found, never came back. The Commerce Department approved the settlement's .com contract on 29 November 2006, and in June 2009 ICANN's board resolved that new top-level domains should not use redirection or synthesised answers at all. The lasting question was how much rested on the name system telling the truth, and who could make it say otherwise. Dan Kaminsky's cache-poisoning flaw showed how resolvers could be fed false answers (July 2008); in February 2010 a federal court, on Microsoft's complaint, ordered VeriSign to stop resolving 277 domain names of the Waledac spam network; and in February 2012 it emerged that VeriSign's own corporate network had been breached in 2010.
The monoculture argument outlasted its lead author's job at @stake. Geer became chief information security officer of In-Q-Tel, the not-for-profit venture firm that invests in technology for the CIA, and later cited Windows Vista's randomised memory layout as evidence that Microsoft had accepted the paper. When a single blow did fall, it came through a security product rather than a worm: on 19 July 2024 a faulty CrowdStrike update crashed some 8.5 million Windows machines, under one per cent of all Windows machines by Microsoft's count (July 2024). Swen's forged patch found its successor in the real one, poisoned at its source — M.E.Doc's update in Ukraine (June 2017) and SolarWinds' Orion (December 2020).