The mail began arriving on Monday 26 January 2004, and it looked like something a mail server sends back. Its subject lines read “Mail Transaction Failed”, “Mail Delivery System”, “Server Report” or just “hi”; one body said the message “contains Unicode characters and has been sent as a binary attachment”. The attachment wore the icon of a Notepad text file. Opened, it filled a Notepad window with garbage while the program mailed itself to addresses gathered from the machine, copied itself into Kazaa's download folder under names such as winamp5 and office_crack, and opened a back door on a TCP port between 3127 and 3198. Craig Schmugar of Network Associates named it after a string in its code, “mydom”; it was also known as Novarg and Shimgapi.
Its first day set a record. MessageLabs, which filtered companies' mail, stopped about 1.2 million copies in the first 24 hours, narrowly passing the mark Sobig.F had set the previous August, and at the peak found the worm in one message in every twelve; security firms called it the fastest-spreading email worm yet. The code also carried a date. From 1 February until 12 February, infected machines were to flood www.sco.com, the website of the SCO Group of Lindon, Utah, whose lawsuit against IBM and claims that Linux contained its copyrighted code had angered Linux users. Attacks had knocked SCO's site offline before, the first in May 2003. On 27 January SCO offered $250,000 for information leading to the author's arrest and conviction.
SCO's chief executive, Darl McBride, said the author was hurting many others besides SCO. On 28 January a variant, MyDoom.B, turned up, set to attack Microsoft's site from 3 February and to rewrite infected machines' hosts files so that they could not reach Microsoft or the anti-virus companies. The next day Microsoft offered $250,000 of its own; “This worm is a criminal attack,” said Brad Smith, its general counsel. A line in the code began “andy;” and went on: “I'm just doing my job, nothing personal, sorry.” Read literally, it suggested someone had paid for the work; who, if anyone, nobody could say.
Early on Sunday 1 February, SCO said, its site was flooded with more requests than it could handle and was completely unavailable, and within days it had taken www.sco.com out of the domain name system and was sending visitors to www.thescogroup.com. A coding error, Virus Bulletin found, let only about a quarter of infected machines join the attack. Microsoft's site stayed up on 3 February: MyDoom.B had spread poorly, Virus Bulletin found a bug that kept its attack from ever starting, and Microsoft had put its MyDoom information on a separate address. MyDoom.A stopped spreading on 12 February, leaving its back doors open. SCO's domain stayed unreachable for more than a month. A year later neither reward had been collected; the author has never been identified.
Ten Business Days
On 1 January 2004 the CAN-SPAM Act, which President George W. Bush had signed on 16 December, came into force across the United States. It did not ban unsolicited commercial email. It required such mail to carry truthful headers and subject lines, to identify itself as an advertisement, to give a valid postal address and to offer a way to opt out, which senders had ten business days to honour. The Federal Trade Commission and state attorneys general could enforce it, internet providers could sue under it, and there were criminal penalties; the people who received the mail could not sue. It also overrode stricter state laws, California's opt-in statute among them. Critics had already nicknamed it the “You-Can-Spam” Act, and Spamhaus, which keeps blocklists of spammers, warned that the United States was set to legalise spamming on 1 January. The first lawsuits under it came in March.
Rapidly Spreading
On Wednesday 28 January 2004, two days after MyDoom appeared, the Department of Homeland Security launched the National Cyber Alert System. It was run by US-CERT, the readiness team Amit Yoran's National Cyber Security Division had set up the previous September, and subscriptions at us-cert.gov were free: alerts in technical and plain-language versions, fortnightly bulletins for technicians and fortnightly tips for home and office users. The CERT Coordination Center at Carnegie Mellon, set up after the Morris worm of 1988, folded its own advisories into the new system's technical alerts. The technical alert issued that day, TA04-028A, was headed “MyDoom.B Rapidly Spreading” and predicted the variant would become very widespread. It did not: Virus Bulletin later reported that only eight samples had been found, most likely those used to seed it. On 3 February Larry Seltzer of eWEEK forwarded the alert to the Bugtraq list under the subject “Hysterical first technical alert from US-CERT”.
The Second Advisory
The Indian Computer Emergency Response Team was set up on 19 January 2004, under what was then the Ministry of Communications and Information Technology, and says it has been operational since that month. It describes itself as “the national nodal agency for responding to computer security incidents as and when they occur”. Its archive shows it at work before then: a first numbered advisory on 6 June 2003, setting out security guidelines for stand-alone and networked computers, and a warning about Blaster on 12 August 2003. Its first advisory of 2004, on 14 January, concerned flaws in H.323, a protocol used for internet telephony and video conferencing. The second, CIAD-2004-0002, rated critical, covered MyDoom on 29 January, three days after the outbreak; the archive misprints its year as 2003.
The advisory told administrators how to clean infected machines, which ports to filter and which mail to stop at the gateway, though it never named the website the worm was built to attack. CERT-In issued 23 advisories in 2004. It could warn, and it could take reports from whoever chose to make them; it could not compel. Nothing in the Information Technology Act of 2000 obliged anyone to tell it anything. Statutory powers came only with section 70B of the amended Act, which made it the national agency for incident response, and a deadline for reporting incidents — six hours — only with its directions of April 2022.
A robot scientist runs its own experiments
In Nature on Thursday 15 January 2004, Ross King of the University of Wales, Aberystwyth, Stephen Oliver of the University of Manchester and their colleagues described a robot scientist. Working from a logical model of how baker's yeast makes its aromatic amino acids, it proposed hypotheses about what particular genes did, chose the experiments that would rule out most of them most cheaply and ran them itself, growing strains each missing one gene, measuring their growth and starting again. Its results matched those of graduate students doing similar work. Framing hypotheses was what some philosophers had thought computers could never do, King said: “the imaginative leap”. Oliver said the next test was whether it could find something new; its successor, Adam, was credited with findings of its own in April 2009. On 7 January NEC had said that PaPeRo, a small home robot it was developing as a family companion, could translate speech between Japanese and English both ways, with 50,000 Japanese and 25,000 English words about travel and tourism.
A reprieve for Windows 98
On Monday 12 January 2004, four days before support for Windows 98 was due to end, Microsoft extended it, and support for Windows Me, to 30 June 2006, so that security fixes could keep coming. Customers in some emerging markets, it said, had understood its product life cycle less well; Kazakhstan, Kenya, Slovenia, Tunisia and Ivory Coast had produced heavy volumes of support calls, and IDC estimated that more than 58 million copies of Windows 98 were installed worldwide. On 16 January Reuters reported Trend Micro's estimate that virus attacks had cost businesses $55 billion in 2003; within days Vmyths, a site that tracked virus hysteria, reported that two of the company's own spokesmen had disowned it, one saying it did not collect the data needed to value damage. Symantec's figures were firmer: on 21 January it reported record quarterly revenue of $494 million, up 31 per cent, almost half of it from a consumer business that had grown by 55 per cent. Support for Windows 98 and Me finally ended on 11 July 2006.
⏳ Time capsule — January 2004
- On 4 January NASA's Spirit rover, cushioned by airbags, landed in Gusev crater on Mars for a mission planned to last at least 90 sols. On 21 January it stopped communicating properly; engineers traced the fault to more files in its flash memory than its software could manage, deleted some, reformatted the memory and had it working normally again by 6 February.
- On 12 January the Queen Mary 2, named by Queen Elizabeth II four days earlier, left Southampton on her maiden voyage to Fort Lauderdale, Florida, with 2,620 passengers. Built by Chantiers de l'Atlantique in France and 345 metres long, she was then the longest and largest passenger ship, and she remains the largest ocean liner ever built.
- On 14 January JPMorgan Chase agreed to buy Bank One in a share deal worth about $58 billion, creating the second-largest bank in the United States, with assets of about $1.1 trillion, and putting Bank One's chief executive, Jamie Dimon, in line to run the combined company from 2006.
- On 25 January, at the Corus tournament in Wijk aan Zee, Viswanathan Anand won the top group with 8½ points from 13 games, and Magnus Carlsen, aged 13, won the C group with 10½, earning his first grandmaster norm. In November 2013, in Chennai, Carlsen took Anand's world title.
The Doors Left Open
The back doors outlasted the drop-dead date. Doomjuice was using them by 9 February, and the war between worm authors that followed belongs to February. The machines it had opened could be rented or sold to spammers, and Virus Bulletin counted around a million of them waiting for someone to send them code. Microsoft's removal tool went looking for it in January 2005; its code, reworked, drove the floods against American and South Korean sites in July 2009. It never quite stopped. In 2019 Palo Alto Networks' Unit 42 reported that it averaged about 1.1 per cent of the emails with malware attachments it saw, most sent from addresses registered in China and still dressed as reports of mail that could not be delivered.
SCO lost its claim to own the Unix copyrights in August 2007 and sought bankruptcy protection in September; its case against IBM ended in a 2021 settlement under which IBM paid the bankruptcy trustee $14.25 million. CAN-SPAM is still the American law, and it supplied counts against a seller of hijacked machines in January 2006 and in Microsoft's case against the Waledac network in February 2010; spam fell by almost two-thirds in an afternoon, by one count, not through the act but when a hosting company was cut off in November 2008. CISA retired the name US-CERT on 24 February 2023; the alerts of 2004 are still on its website. Behind this edition the archive runs back through December 2003 to January 2003.