The first defacement F-Secure heard about came at around 15:00 GMT on Tuesday 21 December 2004, and by 15:12 the Finnish anti-virus company was warning of a new worm. Santy infected web servers, not the PCs that visited them, and only servers running phpBB, free bulletin-board software that F-Secure estimated more than a million sites were using. Where it struck it left a black page in red letters: “This site is defaced!!!” and “NeverEverNoSanity WebWorm generation”, followed by a number. Written in Perl, it found its victims by asking Google. Handlers at the Internet Storm Center saw it search, a hundred results at a time, for addresses containing viewtopic.php — common to phpBB boards, and the page with the flaw — and a random topic or post number.
The hole had been fixed for a month. On 18 November phpBB's developers urged users to delete, without delay, one function call from the code that handled words a visitor asked to have highlighted, and that night released version 2.0.11 as a critical update; a Gentoo Linux advisory six days later said the flaw let an attacker run commands as the web server. Each server Santy took became a searcher. Its exploit carried only about 20 bytes at a time, so it moved in pieces, and copies were easily corrupted. From its fourth generation on it overwrote every file it could whose name contained .php, .htm, .asp, .jsp or .shtm. A reader of F-Secure's weblog found its probes in his logs from 09:25 GMT on Monday 20 December.
How many sites fell was measured with search engines too, and the measurements did not hold. On the afternoon of the 21st an F-Secure researcher reported that a search of MSN for the defacement text found “tens of thousands” of sites; Computer Business Review put the MSN hits at 37,000 around midnight; the BBC wrote on 22 December that Santy had hit more than 40,000 sites within 24 hours. None was a count of sites: two were hit totals, and the BBC did not say where its figure came from. Paging through, F-Secure found that MSN's 29,000 hits ran out on the fifteenth page, with 153 shown, while Google listed 202. How many sites had actually been hit, it wrote, was hard to estimate. The highest generation it found was 22.
The cure was Google's to give. F-Secure spent hours trying to reach the right people there, and that evening Mikko Hyppönen, who led its anti-virus research, asked the weblog's readers whether any of them knew technical staff in the right places at Google. Around midnight GMT Google began refusing the worm's queries, apparently by matching the search terms with the browser name the worm gave, and the spread stopped. Google's security team, by F-Secure's account, wrote afterwards that a response of some seven hours was not outrageous for such a case but that it could and should do better. Over Christmas other Perl worms tried AOL and Yahoo, and on 31 December F-Secure warned that an ‘anti-Santy’ that tried to patch the hole was no beneficial worm either. Searching for victims would become routine.
Twelve Requirements
The rulebook was dated Wednesday 15 December 2004: version 1.0 of the Payment Card Industry Data Security Standard. By the month's end Visa's merchant pages called it a collaboration with MasterCard that took in the requirements of Visa's Cardholder Information Security Program, mandatory since June 2001, and said other card companies operating in the United States had endorsed it. Its twelve requirements were Visa's twelve, reworded and grouped under six headings, from building a secure network to keeping a security policy, and the detail was plain. After authorisation nobody was to keep the full contents of a card's magnetic stripe or its validation code, not even in encrypted form. Security patches were to go on within a month of release, vendors' default passwords were to be changed, no wireless network was to rely on WEP alone, outside scans by a qualified vendor were due every quarter and logs were to be read daily. Visa gave merchants with 20,000 to six million Visa e-commerce transactions a year until 30 June 2005 to show compliance. What the stripe rule meant at a processor in Tucson is the story of June 2005.
A Car Park in Southfield
On Wednesday 15 December 2004, in Charlotte, North Carolina, Judge Lacy H. Thornburg sentenced Brian Salcedo, 21, of Whitmore Lake, Michigan, to 108 months in federal prison, believed by prosecutors to be the longest term yet imposed for computer hacking; Kevin Mitnick's had been 68 months. In October and November 2003, by the government's account, Salcedo and a partner got into the wireless network of a Lowe's store in Southfield, Michigan, put in so that scanners and telephones could work without cables, and through it reached the chain's central computers in North Wilkesboro, then stores in other states, altering card-processing software to keep customers' numbers. Lowe's staff spotted the intrusions and called the FBI, whose agents, watching the Southfield car park that November, found a white Grand Prix with antennas and a laptop in use in the passenger seat. By SecurityFocus's account the bugged program had collected six numbers; Lowe's said the men obtained none. A stipulated potential loss above $2.5 million had put his guideline range at 12 to 15 years, by the same account; the prosecutor was Matthew Martens. His partner, Adam Botbyl, received 26 months.
Counting the Defaced
On 24 December 2004 CXOtoday, writing from Mumbai, reported a study by the Indian Computer Emergency Response Team of the defacements of websites under India's .in domain recorded from 1998 to 20 September 2004. CERT-In's analysts found 667 records, against 6,430 registered .in domains in a count published by the National Centre for Software Technology, which left out the subdomains of the government's nic.in and the academic network's ernet.in. Commercial .co.in sites accounted for 242; government .gov.in defacements were rising, from one in 1999 to 43 in 2003 and 42 by September 2004. The worst day was 5 February 2004, when 27 .in sites were defaced, 14 of them at a single address; sites under railnet.gov.in, on Indian Railways networks, had been re-defaced 16 times.
Every figure came, at one remove, from the defacers. The records were taken from mirror sites such as zone-h.org, which archive defacements usually reported by the attackers themselves and then verified. More than 150 hackers and groups appeared; one, the Anti India Crew, accounted for about 15 per cent, and the study reported that the members of the four most active groups were said to be mostly from Pakistan, without saying by whom. Indian sites under .com and other generic domains were left out as too hard to identify. The base was about to grow: from 1 January 2005 the new .IN Registry opened .in names to anyone, anywhere. In 2006 alone CERT-In would count 1,226 defacements under .in among 5,211 of Indian sites (August 2006).
Learned distances at NIPS, a running ASIMO
The Neural Information Processing Systems conference met in Vancouver from 13 to 16 December 2004, before two days of workshops at Whistler, and its proceedings held 207 papers. In one, Jacob Goldberger, Geoffrey Hinton, Sam Roweis and Ruslan Salakhutdinov set out neighbourhood components analysis, which learned the distance measure for nearest-neighbour classification by maximising a stochastic version of its leave-one-out score. Yee-Whye Teh, Michael I. Jordan, Matthew Beal and David Blei proposed the hierarchical Dirichlet process, a non-parametric Bayesian model, tried on three collections of text, in which related groups of data shared clusters whose number was inferred rather than fixed; Nathan Srebro, Jason Rennie and Tommi Jaakkola approached collaborative prediction, guessing one person's preferences from many people's, with low-norm rather than low-rank factorisations. On 15 December Honda announced technology for a next-generation ASIMO that could run at 3 km/h, both feet leaving the ground for 0.05 seconds at a time. Salakhutdinov and Teh would be among Hinton's co-authors when deep networks returned in July 2006, and ASIMO's pace doubled within a year (December 2005).
Symantec and Veritas to merge; Microsoft buys GIANT
On Thursday 16 December 2004 Symantec and Veritas Software announced an all-stock merger valued at about $13.5 billion at Symantec's closing price the day before. Each Veritas share was to become 1.1242 Symantec shares, leaving Symantec's holders with about 60 per cent of a company whose revenue was forecast at some $5 billion for the year to March 2006. John W. Thompson would stay on as chairman and chief executive, with Veritas's Gary Bloom as vice-chairman and president, and the case for joining security to Veritas's backup and storage-management software was what Thompson called “information integrity”. The same day Microsoft said it had acquired GIANT Company Software, maker of GIANT AntiSpyware, on terms it did not announce, and promised within a month a beta of a spyware detection and removal tool for Windows 2000 and later, citing an IDC study's estimate that 67 per cent of consumer PCs were infected with some form of spyware. The program, renamed Windows Defender, became Vista's built-in anti-spyware; Symantec agreed to sell Veritas in August 2015.
⏳ Time capsule — December 2004
- On 7 December IBM agreed to sell its personal computer business, ThinkPad included, to Lenovo of Beijing for $1.25 billion in cash and stock, with Lenovo taking on $500 million of liabilities and moving its headquarters to New York. The deal closed on 3 May 2005.
- On 14 December the Millau Viaduct, designed by the engineer Michel Virlogeux and the architect Norman Foster, was inaugurated across the Tarn valley at Millau, in France, and two days later it opened to traffic. Its structural height of 343 metres made it the world's tallest bridge for more than two decades; it had cost about €394 million.
- On 27 December a flash of gamma rays from SGR 1806−20, a magnetar some 42,000 light-years away on the far side of the Milky Way, reached Earth. In a tenth of a second it had released more energy than the Sun gives out in about 150,000 years, and it briefly expanded the ionosphere; it was the brightest event yet recorded from beyond the solar system.
- On 31 December Taipei 101 was formally opened, classified from that day as the world's tallest building. A 660-tonne steel pendulum hung between its 92nd and 88th floors to damp its sway, and its first New Year's fireworks followed a few hours after the ceremony.
The Index as a Map
Santy's method outlived Santy. A year earlier, the Storm Center recalled, defacers had used Google to find vulnerable YaBB boards, though not with a worm; afterwards the search became a standard step, built into tools. The mass SQL injections of 2008 were aimed at ASP pages that search engines had indexed, and when a wave reached what researchers estimated were hundreds of thousands of pages that April, the count was again a matter of search results (April 2008). The raiders who wiped MongoDB databases in January 2017 needed no exploit, only addresses that Shodan had been indexing for years. In 2026 the question Santy put to Google, which servers run the vulnerable software, is put to indexes built for asking it.
The two stories of 15 December ran on through this archive as well. Investigators traced TJX's intruders, the Wall Street Journal reported, to the car park of a Marshalls store in St Paul, Minnesota, where a laptop and an antenna had read a wireless network running WEP, the protection the new standard told merchants never to rely on alone (October 2007). The crew indicted in August 2008 had gone wardriving for retailers' networks, and in March 2010 its leader, Albert Gonzalez, was sentenced to twenty years, more than twice the term that prosecutors in Charlotte had called a record.