On Tuesday 20 April 2004 Britain's National Infrastructure Security Co-ordination Centre published advisory 236929, Vulnerability Issues in TCP, and the US Computer Emergency Readiness Team put out an alert of its own the same day. TCP lets either side of a connection close it at once with a reset packet, and a stranger forging one had commonly been thought to need the right sequence number out of some four billion. In fact the receiving machine would accept any number that fell inside its window, the range of data it was ready to take, and the wider the window, the fewer guesses an attacker needed. The centre judged the Border Gateway Protocol, by which the internet's networks exchange their routes, “potentially most affected”.
The finding was Paul Watson's. A researcher credited by Cisco to the Open Source Vulnerability Database project, he had found it late in 2003 and was to present it that week at CanSecWest in Vancouver as Slipping in the Window: TCP Reset Attacks. On his figures, as US-CERT gave them, an attacker sending 250 packets a second over a DSL line could get a forged packet accepted into a connection with a 65,535-byte window about every five minutes, and over a T-1 line about every fifteen seconds. BGP sessions, long-lived and between known addresses, made the best targets. Reset one and every route learned over it was withdrawn; reset it repeatedly, the Internet Storm Center noted, and the flapping could trigger route dampening, suppressing those routes for longer still.
The warning had travelled ahead of the news. Equipment makers had been told in advance, and US-CERT's vulnerability note carried statements from Cisco, Nortel, Redback and Sun. Cisco's advisories went out at 21:00 UTC that evening, listing fixed releases, some due within days, urging BGP peers to protect their sessions with the MD5 signature option, and reporting that the cooperating vendors had found a forged SYN packet could cut a connection too. Cisco said it knew of no malicious use. US-CERT put the stakes soberly: sustained attacks could deny service to parts of the internet, but routing would recover quickly once they stopped.
Tools followed the advisory. On 21 April the SANS Internet Storm Center reported that a TCP reset tool for Windows had been released that day, and warned that existing intrusion-detection signatures might miss it; it kept its own alert level at green. The lasting defence was the one the advisories had urged, a shared secret on every BGP session, and on Windows the fix came late. Microsoft, whose MS04-011 had fixed fourteen Windows flaws on 13 April, among them the one Sasser would use at the month's end, patched the reset weakness only in April 2005, in MS05-019, rating it low; it had seen proof-of-concept code published but no reports of attacks on its customers.
Read by a Machine
On 1 April 2004 Google announced Gmail, free webmail with 1,000 megabytes of storage, more than a hundred times what Yahoo and Microsoft gave away, because, it said, “people should be able to hold onto their mail forever”. It was paid for by reading: Gmail's computers would scan the text of each message and choose advertisements to show with it. On 6 April thirty-one privacy and civil-liberties groups asked Google to suspend Gmail until its privacy problems were addressed. Google's answer was that machines, not people, would read the mail; a machine, the critics argued, could be as invasive. Within weeks Privacy International had complained to Britain's Information Commissioner, and Liz Figueroa, a California state senator, had amended a bill of hers to restrict the scanning. Google revised its privacy policy to explain that deleted mail could linger in its backups for some time. The bill passed the state Senate 25 to 8 on 27 May, rewritten to permit the scanning within limits, and died in the Assembly that November.
The First Providers
On Thursday 22 April 2004 the Justice Department announced Operation FastLink, which it called the largest multinational law-enforcement effort ever directed at online piracy: in the previous 24 hours more than 120 searches had been carried out in 27 American states and ten other countries, Israel and Singapore among them. Four undercover investigations, led by the FBI with the department's Computer Crime and Intellectual Property Section, were aimed at what the department called the first-providers, the original source of most pirated works online: release groups such as Fairlight, Kalisto, Echelon, Class and Project X, which specialised in computer games, and APC, which released music. These, it said, were hierarchical organisations that moved material through secure top-level servers before it reached chat channels and peer-to-peer networks. More than 200 computers were seized, 30 of them servers, and nearly 100 people had been identified. The department put the works seized at more than $50 million on conservative estimates, a value on the works, not a measure of losses. The announcement named no one as charged; by March 2009 the operation had produced sixty convictions, by the government's count.
Two Boxes and a Cable
India began voting on 20 April 2004, the first of four polling days that ran to 10 May, with the count set for 13 May; some 671 million people were on the rolls. For the first time every polling station used electronic voting machines: more than a million of them, about 10.75 lakh by one later account, in all 543 parliamentary constituencies, twenty-two years after a first trial at 50 polling stations in a by-election at Parur in Kerala. Two public-sector companies, Bharat Electronics in Bangalore and the Electronics Corporation of India in Hyderabad, made them.
Each was two boxes joined by a five-metre cable: a control unit kept by the polling officer, and a balloting unit in the voting compartment with a button beside each candidate's name and symbol, sixteen to a unit and up to four units to a machine. The control unit ran on a battery, so the machines worked where there was no electricity, and they had no network connection; their program was fixed at manufacture. What guarded them was procedure. They were sealed and unsealed in front of the candidates' agents and held in custody until every result could be declared at once. The arguments about the machines, and the paper trail that answered them, came later, as April 2009 recounts.
Echo state networks predict a chaotic series
In Science on 2 April 2004 Herbert Jaeger and Harald Haas of International University Bremen described echo state networks, a way round the slow training of recurrent neural networks. They kept a large random network fixed, 1,000 sparsely connected neurons for the Mackey-Glass benchmark, and trained only its output connections, so that learning became a linear regression taking seconds. On that chaotic series they beat the best earlier predictions by a factor of 700, or 2,400 with a refined method; equalising a model wireless channel, a 46-neuron reservoir cut the symbol error rate a hundredfold at high signal-to-noise ratios. In the 6 April issue of PNAS Thomas Griffiths and Mark Steyvers fitted Blei, Ng and Jordan's topic model by Gibbs sampling to 28,154 of the journal's abstracts from 1991 to 2001: 300 topics fitted best, with climate change, gene knockouts and apoptosis rising and sequencing and cloning falling. Echo state networks and the essentially equivalent liquid state machines, developed independently, are now grouped as reservoir computing, pursued even in optical and chemical hardware.
Claria's prospectus and the spyware workshop
On Thursday 8 April 2004 Claria, formerly Gator, filed to raise up to $150 million in a public offering. Its software, bundled with free programs such as Kazaa, reached more than 43 million users with pop-up advertisements chosen from their browsing; in 2003 it had earned $34.9 million on revenue of about $90.5 million. Among its risks the prospectus listed spyware detectors such as Ad-Aware and products from McAfee, Symantec, AOL and EarthLink, which flagged its software and prompted users to uninstall it; that, it warned, “could significantly reduce the size of our user base”. On 12 April its rival WhenU sued to void Utah's Spyware Control Act (March 2004) before it took effect. At the Federal Trade Commission's spyware workshop on 19 April, McAfee's Bryson Gordon said spyware had for about a year been a larger technical-support problem than viruses, and WhenU's chief executive offered 80 million removals among more than 100 million installations as evidence of consent. Claria withdrew its offering in August, citing market conditions, and in March 2006 said it would leave adware altogether.
⏳ Time capsule — April 2004
- On 3 April Amberleigh House, ridden by Graham Lee, won the Grand National at Aintree at 16–1, giving the trainer Ginger McCain his fourth win in the race, 31 years after his first with Red Rum.
- On 5 April the Pulitzer Prizes went to Edward P. Jones's The Known World for fiction and Anne Applebaum's Gulag: A History for general non-fiction; the public-service prize went to The New York Times for its reporting on workers killed and injured on the job and the employers who broke basic safety rules.
- On 12 April, on the third day of the fourth Test against England in Antigua, Brian Lara reached 400 not out from 582 balls, with 43 fours and four sixes, taking back the record for the highest Test innings, which Matthew Hayden had raised to 380 in 2003.
- On 29 April the last Oldsmobile, an Alero with the signatures of plant employees inside its hood, left General Motors' Lansing Car Assembly plant in Michigan, ending a marque begun in 1897 and the oldest automotive brand name in the United States.
Answered with a Challenge
The standard took six years to catch up. RFC 5961, of August 2010, which cites Watson's talk, has TCP answer a reset that lands in the window but not on the exact next sequence number with an acknowledgement, a challenge, and drop the connection only if a reset with that exact number returns. The cure carried a flaw. In August 2016 researchers from the University of California, Riverside, and the US Army Research Laboratory showed that Linux, counting those challenges against one global limit, let an attacker off the path learn whether two hosts were talking, then reset or inject into the connection, in forty to sixty seconds. The routing crises later in this archive were not forged resets but routes wrongly announced or withdrawn, from February 2008 on.
Gmail's bargain lasted thirteen years. On 23 June 2017 Diane Greene, chief executive of Google Cloud, wrote that consumer Gmail content would “not be used or scanned for any ads personalization”; the service had more than 1.2 billion users. By then the sharper question was what a provider might open for its own reasons, as Microsoft had done with a blogger's Hotmail inbox (March 2014). Indian law has since reached the points pressed in 2004: the Digital Personal Data Protection Act, whose duties on companies take effect in May 2027, asks for consent that is specific and as easy to withdraw as to give, and for data to go once its purpose is served. India's voting machines have served every election since, with a paper trail beside each by May 2019.