Late on Thursday 12 February 2004 Microsoft confirmed that some of its most closely guarded property was loose. “Incomplete portions of Windows 2000 and NT 4.0 source code was illegally made available on the Internet,” said a spokesman, Tom Pilla. He saw no sign of a breach of Microsoft's own network, and the company had asked the FBI to investigate; within a week it confirmed two compressed files of about 200 megabytes each. The code was more than two years old and, as CNET noted, seemed to lack the server and network services most likely to enable remote attack. Howard Schmidt, Microsoft's former security chief, feared more for the company's intellectual property than for security: “From a security standpoint, this is sort of like capturing a 1956 Russian fighter jet.”
The files pointed elsewhere. Russ Cooper of NTBugtraq found three references in the Windows 2000 code naming Mainsoft as the licensee, though he warned that someone could have planted the name; the Associated Press reported that a core dump among the files, a diagnostic record written after a crash, carried the e-mail address of Mainsoft's technology director. “If someone was doctoring this, they did quite a good job,” said Chris Wysopal of @stake. Mainsoft, of San Jose, had had access to parts of the Windows source since at least 1994 for its tools that ported Windows programs to Unix. It would not confirm the leak was its own but promised full co-operation; its chairman, Mike Gullard, said it recognised “the gravity of the situation”. Microsoft would not discuss the relationship.
Within four days someone claimed the code had yielded a hole. On Monday 16 February an alert forwarded to the Bugtraq mailing list described an integer overflow in Internet Explorer 5's handling of bitmap images, through which a crafted picture could run code on a visitor's computer; its author said it had been found by reading the leaked source. Microsoft answered that it had already found the flaw itself and fixed it in Internet Explorer 6 Service Pack 1, and urged users to upgrade. Then it went after the copies: letters telling people who had downloaded the code that they had broken the law, and warnings shown to anyone searching for it on several peer-to-peer networks. Marc Maiffret of eEye Digital Security thought it “a pretty wasted endeavor”.
A seller surfaced the same day. On 12 February, as Microsoft learned of the leak, William Genovese Jr. of Meriden, Connecticut, announced on his website, illmob.org, that he had a copy for sale. An investigator for a security firm hired by Microsoft e-mailed him for one; Genovese asked for $20 by PayPal and, once it cleared, supplied a download address. In July an undercover FBI agent downloaded the code after a second payment. Arrested on 9 November 2004, aged 27, and charged under the Economic Espionage Act, he pleaded guilty in August 2005. On 27 January 2006 Judge William H. Pauley III gave him two years in prison, calling him “well on his way to being a cyber-predator”. Prosecutors said only that others had taken it first.
Two Hundred Days
On Tuesday 10 February 2004 Microsoft released MS04-007, fixing its ASN.1 library, the code Windows used to decode the data inside digital certificates and Kerberos and NTLMv2 logins; US-CERT warned that an unauthenticated attacker could use the flaws remotely to run code with full system privileges on versions from NT 4.0 to Server 2003. eEye Digital Security, whose Derek Soeder had found them, said it had reported the first on 25 July 2003 and the second on 25 September. “We contacted Microsoft about these vulnerabilities 200 days ago, which is insane,” its co-founder Marc Maiffret told Reuters; Microsoft said the flaw ran so widely through its software that a proper fix had needed extra time and investigation. On 14 February the SANS Internet Storm Center reported published code that killed lsass.exe, which handles Windows logons, and restarted the machine about a minute later; it reportedly worked only on Windows 2000 Professional. eEye was still waiting on a report it had made on 8 October 2003, about the Local Security Authority service; Microsoft fixed it on 13 April, and Sasser came through it at the end of that month.
Worms Against Worms
On Monday 16 February 2004 a new mass-mailing worm, Netsky, appeared, and on the 18th its B variant became the first of the family to spread widely, arriving as an attachment under subject lines such as “hi” and copying itself where Kazaa and other file-sharing programs would offer it. It also changed the registry to switch off MyDoom.A and MyDoom.B, January's worms, wherever it found them. Netsky.C, flagged on 25 February, boasted “we kill malware writers (they have no chance!)” and called MyDoom.F, out the previous week, a thief of its idea. The replies came in the first days of March: a Bagle variant asked whether Netsky's author wanted to start a war, a MyDoom variant lectured its author on peer-to-peer networks, and Netsky.F called Bagle's author a loser. On 3 March five new variants appeared in three hours. “Whoever is behind it is sitting around waiting for us to respond,” F-Secure's Mikko Hyppönen said. In May police in Germany arrested Netsky's author, a teenager who had also written Sasser.
A Register at the Counter
Much of India's internet was used away from home. The country had about seven million personal computers for a billion people, and an estimated four million internet subscribers but some 18 million users, a growth the cyber cafés had done much to carry. In late January 2004 police in Mumbai said they would put new measures against cybercrime to the Maharashtra government, and the state legislature was due to take them up in February. Café owners would need a licence and would have to install, at their own expense, software to block pornography and other content deemed unsuitable; customers would have to show identification and give an address and telephone number, recorded on forms the police could ask to see. The police said they needed the powers against terrorists, hackers, paedophiles and visitors to adult sites.
Bombay's café owners, fearing that customers asked for their details would stay away, formed the Association of Public Internet Access Providers to resist. Its president, Ashish Saboo, argued that a register of this kind was “completely ineffective” against computer fraud or cyberterrorism and could close almost half the cafés. Examination of the law was shelved for the time being, Reporters Without Borders reported that September, but the idea travelled: by November Karnataka required its cafés to keep a record of their users and to photograph with a webcam anyone who had no identity card. The register became national in April 2011, when the IT ministry's cyber-café rules forbade letting anyone use a café's computer until their identity was established and required every user to be logged for at least a year.
The W3C approves OWL; DARPA drops LifeLog
On Tuesday 10 February 2004 the World Wide Web Consortium approved two Semantic Web standards: a revised RDF, for machine-readable statements about resources, and OWL, the Web Ontology Language, for setting out the terms of a field such as medicine or finance and the relations between them. OWL was a revision of DAML+OIL, and so descended partly from DARPA's Agent Markup Language, begun in 2000 under Jim Hendler, who co-chaired the working group that wrote it. Another DARPA project fared worse: on 4 February Wired News reported that the agency had quietly dropped LifeLog late in January. It was to gather nearly everything a person said, saw or did, from calls and e-mail to television and tickets; backers said it would advance research in artificial intelligence, critics that it could become a tool for profiling. A DARPA spokeswoman, Jan Walker, cited only “a change in priorities”. In September the Pentagon was reported to be reviving parts of it as ASSIST, to record what soldiers saw and did in combat; OWL 2 followed in October 2009.
Trend Micro walls off worms; senators propose SPYBLOCK
On Monday 16 February 2004 Trend Micro announced Network VirusWall 1200, a $5,995 appliance against worms such as Blaster and Code Red, which spread by exploiting flaws rather than as e-mailed files. Inside a company's network it inspected passing traffic for the signatures of known worms, flagged unknown ones by their behaviour and could seal off an infected segment; without software on the client, it could also bar machines such as contractors' laptops with out-of-date anti-virus definitions. By 2007 its successors were sold as network access control appliances. On 26 February Senators Conrad Burns, Ron Wyden and Barbara Boxer announced the SPYBLOCK Act, which would have banned installing software on another person's computer without notice and consent, required reasonable uninstall procedures for downloadable software and left enforcement to the Federal Trade Commission and state attorneys general. Wyden spoke of “virtual Peeping Toms”. It cleared the Senate Commerce Committee in September but died without a floor vote; reintroduced in March 2005, it got no further than a committee report in June 2006.
⏳ Time capsule — February 2004
- On 2 February Roger Federer, who had beaten Marat Safin 7–6, 6–4, 6–2 in the Australian Open final in Melbourne for his first title there and his second major, became world No. 1 for the first time; he held the ranking for a record 237 consecutive weeks.
- On 4 February Mark Zuckerberg launched TheFacebook, at thefacebook.com, with his Harvard roommates Eduardo Saverin, Andrew McCollum, Dustin Moskovitz and Chris Hughes. It was open only to Harvard students; more than half the university's undergraduates registered within a month, and in March it opened to Stanford, Columbia and Yale.
- On 17 February AT&T Wireless chose Cingular's offer of more than $41 billion over Vodafone's. The sale closed on 26 October, and the combined company became the largest wireless carrier in the United States.
- On 29 February, at the 76th Academy Awards at the Kodak Theatre in Hollywood, The Lord of the Rings: The Return of the King won all eleven Oscars for which it had been nominated, best picture and best director among them, equalling the record of Ben-Hur and Titanic.
The Recipe and the Clock
In hindsight the leak was a property case more than a security one. The flaw said to have come from it had already been fixed in the browser's current version, and Microsoft pursued the copies as stolen goods — “our secret formula like the Coke formula”, its associate general counsel, Tom Rubin, called the code when Genovese was arrested. Sixteen years later, after intruders had read code in its repositories, Microsoft said it did not treat the secrecy of source code as a security boundary. Stolen code has since mattered more as a map than as a prize: the source of Google's single sign-on system went in Operation Aurora, and F5's BIG-IP code went together with details of flaws not yet patched.
eEye's two hundred days were an early public measure in the quarrel over how long a vendor may take. eEye went on to publish stopgap fixes of its own ahead of Microsoft's, for Internet Explorer in March 2006 and for animated cursors in April 2007; Google's Project Zero, founded in 2014, ran a ninety-day clock on every bug it reported, and in January 2015 that clock ran out twice on Microsoft. The sentence passed on Netsky's author belongs to May's story; in December Graham Cluley of Sophos called 2004 “the year of the Netsky”: Netsky-P alone accounted for almost a quarter of the virus incidents reported to Sophos in the year to November 2004.