Microsoft released Windows XP Service Pack 2 to manufacturing on Friday 6 August 2004, about two years after Service Pack 1. Planned for 2003, it had been rebuilt around security as attacks mounted. Its largest change was a default: XP's firewall, until then Internet Connection Firewall and not on as shipped, became Windows Firewall and was switched on, closing ports except while they were in use. Data Execution Prevention, on capable processors, refused to run code from memory marked as data. A Security Center showed whether a firewall, Automatic Updates and anti-virus software were working; Internet Explorer gained a pop-up blocker and an add-on manager; files downloaded in Internet Explorer or saved from Outlook Express were marked with the zone they came from, so Windows could warn before they ran.
Delivery was the argument. Microsoft expected Automatic Updates to carry SP2 to about 100 million PCs within two months. On Monday 9 August it posted a package of some 270MB for administrators installing over networks, said automatic delivery to individual PCs would begin on 16 August, and released a tool to block it for 120 days; business customers complained that the notice was short. The dates moved: Home Edition users began receiving SP2 on 18 August and Professional users on 25 August, when it also went up on Windows Update and free CDs could be ordered.
It broke things, as Microsoft had warned. Within days its knowledge base listed dozens of programs that stopped working, its own Visual Studio .NET and SQL Server among them, and more that behaved differently. The firewall, Microsoft said, would refuse wanted traffic with the unwanted until it was configured. IBM told its staff not to install it until the company's own testing was done, and many corporate IT departments held it back for the same reason. On 13 August Heise Security described two ways past the new download warnings, both needing the user's help; Microsoft, Heise said, saw no need for a patch.
Companies still wanted time, and Microsoft doubled the block to 240 days: from Tuesday 12 April 2005, Automatic Updates would deliver SP2 regardless. By July 2005 it had distributed more than 218 million copies, and Mike Nash, a Microsoft corporate vice-president, said its internal analysis found SP2 machines 13 to 15 times less likely to be infected by some of the most prevalent malicious software than XP with no service pack or the first. The figures are Microsoft's own. Support for SP2 ended on 13 July 2010.
Fatally Wounded
On the evening of Tuesday 17 August 2004, at the rump session of the CRYPTO 2004 conference in Santa Barbara, Xiaoyun Wang, Dengguo Feng, Xuejia Lai and Hongbo Yu, of Shandong University, the Chinese Academy of Sciences and Shanghai Jiaotong University, presented collisions — different messages with the same digest — in MD5; their paper added MD4, HAVAL-128 and RIPEMD. The version they had first circulated carried a flaw — its MD5 collision held only for a non-standard starting value, an error reportedly traced to byte order — and a revision posted on 17 August corrected it. The revision gave two MD5 collisions between 1,024-bit messages, the first 512-bit block found in about an hour on an IBM P690, the second in fifteen seconds to five minutes. Part of the audience stood to applaud, Princeton's Ed Felten reported; MD5, he wrote, was “fatally wounded”. Antoine Joux and colleagues had announced a collision in the full SHA-0 on 12 August. SHA-1's turn came in February 2005, and a certificate authority forged through MD5 in December 2008.
Attacks for Hire
On Thursday 26 August 2004 Attorney General John Ashcroft announced Operation Web Snare, run since 1 June: more than 160 investigations, more than 150,000 victims, estimated losses above $215 million and, by the department's count, “more than 150 arrests or convictions”. Its release also counted 117 complaints, informations and indictments and more than 140 search warrants. One case was, the department said, the first denial-of-service case for commercial advantage. Jay R. Echouafni, chief executive of Orbit Communication, a Massachusetts satellite-television retailer, was indicted that week, accused of hiring hackers in Arizona, Louisiana, Ohio and Britain to flood rivals' websites from October 2003. One victim, WeaKnees.com, was offline for about two weeks at worst; an attack on another's host blocked access to Amazon.com and the Department of Homeland Security for an hour. Prosecutors put lost revenue and response costs at over $2 million. Arrested in March as he returned from Morocco and freed on $750,000 bail secured by his house, Echouafni had vanished, believed by officials to be in Morocco.
The Missing Log
On 4 August 2004 Jolly Technologies, a San Carlos, California, maker of labelling and card software, said a recently hired software engineer at its research centre in Mumbai, open less than three months, had used her Yahoo email account, which then allowed 100MB of free storage, to upload and send out portions of the source code and confidential design documents of one of its key products. Its president, Sandeep Jolly, dated the transfer to 19 July; the engineer, he said, had left without notice. The company halted development in India, saying a sluggish legal system and the absence of intellectual-property laws made the agreements its staff signed nearly impossible to enforce.
The police did not register a case. Mumbai's commissioner, Anami Roy, said a preliminary inquiry with technical experts had found nothing to show any file had left the engineer's office computer, that Jolly had refused to make a formal complaint, and that the inquiry had disclosed no cognizable offence. Vijay Mukhi, the police's technical consultant, said the centre had no security policy and no log of computer and network activity, and that its passwords were widely known. Jolly disputed the police's account and said the log existed; we found no record that a case was ever registered, or of how the dispute ended. CERT-In's directions of April 2022 now require companies to keep logs of all their ICT systems for a rolling 180 days, within India.
Mining customer reviews at KDD in Seattle
The tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining met in Seattle from 22 to 25 August 2004. One of its papers, by Minqing Hu and Bing Liu of the University of Illinois at Chicago, set out to summarise a product's customer reviews: their system found the features reviewers wrote about, picked out the sentences expressing opinions on them, judged each positive or negative with the help of WordNet, and tallied the verdicts feature by feature. On reviews of five electronics products, two digital cameras among them, collected from Amazon.com and CNET, it judged a sentence's orientation correctly 84 per cent of the time on average. The conference's best research paper award went to Sugato Basu, Misha Bilenko and Ray Mooney of the University of Texas at Austin, for a probabilistic framework for semi-supervised clustering. In Valencia, from 22 to 27 August, the sixteenth European Conference on Artificial Intelligence drew 653 submissions from 45 countries. In 2015 Hu and Liu's paper won KDD's test-of-time award, its citation crediting it with inspiring aspect-based sentiment analysis.
Computer Associates buys PestPatrol
On Monday 16 August 2004 Computer Associates bought PestPatrol, a private company in Carlisle, Pennsylvania, founded in 2000, whose software found and removed spyware, adware, Trojan horses and denial-of-service agents. CA would sell it as eTrust PestPatrol beside its anti-virus and anti-spam products; terms were not disclosed, though CA's next quarterly filing put the price at about $40 million, in cash. Matthew Kovar of the Yankee Group called it “one of the first significant acquisitions from a malware perspective”. Two days later Symantec announced its Norton 2005 consumer line, whose anti-virus program, it said, would detect spyware; CA's Sam Curry said the major anti-virus vendors were retooling to detect spyware but could not clean it. On 12 August Kaspersky Lab moved to hourly updates of its anti-virus databases, from every three hours, having released more than 1,500 updates that year against 63 in 2000. PestPatrol was renamed CA Anti-Spyware in 2007, and in June 2011 it went with the rest of CA's anti-virus business to Updata Partners, which relaunched the business as Total Defense.
⏳ Time capsule — August 2004
- On 13 August Julia Child, who had brought French cooking to American kitchens with Mastering the Art of French Cooking in 1961 and to American television with The French Chef, died in Montecito, California, two days before her 92nd birthday.
- From 13 to 29 August Athens, host of the first modern Olympics in 1896, held the Summer Games again: 201 nations, 301 medal events. On 17 August, at the Markópoulo shooting centre, Rajyavardhan Singh Rathore scored 179 in the double trap for silver behind Ahmed Al Maktoum of the United Arab Emirates, independent India's first individual Olympic silver.
- On 19 August Google became a public company, offering 19,605,052 shares at $85 each; the sale raised $1.67 billion and gave it a market value of more than $23 billion.
- On 31 August AMD showed what it called the industry's first x86 dual-core processor: four dual-core Opterons, made on a 90-nanometre process, running in an HP ProLiant DL585 server at its Austin facility, with the chips due to ship in mid-2005.
Where the Default Did Not Reach
That the default firewall helped close the era of fast network worms is a common view, and a hard one to test: SP2 brought hundreds of fixes and other hardening with it, and the infection figures are Microsoft's. Its limit was what it did not reach. Microsoft did not bring SP2's protections to Windows 2000, which still ran on a large share of corporate desktops. The next August Zotob could reach anonymously only that system (August 2005). Conficker, through the service that shares files and printers, was counted in millions of machines in January 2009, and XP's regular patches stopped on 8 April 2014 (April 2014).
MD5 lingered and was retired by stages: Flame's builders still found a Microsoft certificate to forge, with a collision attack of their own, in June 2012, and in August 2026, as February 2005 records, India's Controller of Certifying Authorities told developers and certifying authorities not to use it, or SHA-1, for new signatures. Attacks for hire became businesses with customer lists: LizardStresser's 14,241 registered usernames were broken open in January 2015, and in October 2024 American prosecutors charged two Sudanese brothers over an operation tied to more than 35,000 attacks (June 2023). The chief executive at the centre of Web Snare's first such case has, on every record we found, never stood trial.