On Thursday 24 June 2004 Marcus Sachs, the handler on duty at the SANS Institute's Internet Storm Center, posted a request for information under a heading that ended “Russian IIS Hacks?” Web servers running Internet Information Services 5.0, the web server in Windows 2000, had been altered so that a setting for a document footer pointed to a new file of about a kilobyte in the system folder. Every page they sent, and every image, went out with a few lines of JavaScript attached, though the files on disk were untouched. In a browser the script added a one-pixel frame that called a server at 217.107.218.147, in Russia, and set a cookie so that it would not fire again for ten minutes. The earliest infection reported dated from 20 June.
A visitor using Internet Explorer had only to load the page. Through flaws in the browser, at least one of them unpatched, the Russian server installed whichever program it was handing out: keystroke loggers, proxies, back doors; one, Berbew, captured passwords typed into banking, shopping and auction sites. When the Storm Center checked, most anti-virus products did not yet recognise the main program. NetSec, a managed-security firm that had spotted the traffic on its customers' networks, would say only that the sites included an online auction, a search engine and a comparison-shopping site, all of them large; the Storm Center withheld its list, which included, it said, businesses it presumed would normally keep their sites fully patched.
Microsoft said internet service providers and law enforcement, working with it, had traced the attack to a server in Russia and shut it down on Thursday 24 June; by the next day the address no longer answered. Microsoft called it a targeted, manual attack on particular servers, not a worm or virus, and said IIS 5.0 servers without MS04-011, its update of April, were susceptible; some administrators told the Storm Center theirs had been fully patched. The US Computer Emergency Readiness Team warned that sites it did not name had been compromised, and advised switching off active scripting; within days its note on one of the browser flaws said exposure could be reduced “by using a different web browser”.
Microsoft's first remedy came on Friday 2 July: a configuration change to Windows that switched off ADODB.Stream, a component the exploit relied on. It protected against Download.Ject, as Microsoft called the attack — to anti-virus companies the script was Scob — though US-CERT cautioned that it might not stop every attack; the fix for the browser flaw itself, MS04-025, followed on 30 July. By then the Mozilla Foundation's engineering director had told Wired that daily downloads of its browsers had doubled, to about 200,000. For the servers themselves the Storm Center's advice was a full rebuild, since intruders who could set a footer had probably left other back doors. Firefox 1.0 arrived on 9 November (November 2004).
Caribe
On 15 June 2004 Kaspersky Lab announced what it described as the first worm for mobile phones. The sample had reached its laboratory by email, an attachment with no message, from a sender its analysts knew for passing on new viruses from European writers, and other anti-virus companies had been sent it too. Roman Kuzmenko, the colleague the duty analyst asked for help, worked out within hours that it was a program for Symbian phones; strings inside pointed to 29A, a virus-writing group known for proofs of concept. Cabir ran on Series 60 phones. It arrived as an installation file posing as a security utility, wrote “Caribe” on the screen each time the phone was switched on, and searched by Bluetooth for another phone to send itself to, whose owner had to accept and install it. It carried no destructive payload, and Kaspersky had seen no sign of it spreading; it was a proof of concept, not yet an epidemic. Its source code later circulated, variants followed, and in August 2005 Cabir spread through the stands at the athletics world championships in Helsinki.
Ninety-Two Million Names
On 23 June 2004 federal prosecutors in Manhattan charged Jason Smathers, a 24-year-old software engineer at America Online's headquarters in Dulles, Virginia; he was arrested at home in West Virginia, and AOL fired him. In 2003, they alleged, he had used another employee's access code to reach a customer database closed to him and taken some 92 million screen names, belonging to about 30 million members, with zip codes, telephone numbers and the types of credit card used, though not card numbers. The Secret Service's inquiry was helped by a spammer who had bought the list. Sean Dunaway, 21, of Las Vegas, was accused of buying it to promote an internet gambling business and selling it on to spammers. Both were charged with conspiracy, in a case that drew on the new CAN-SPAM Act. In December 2004 a first plea agreement was refused, the judge unconvinced that any crime had been committed. Smathers pleaded guilty in February 2005 and admitted accepting $28,000; on 17 August Judge Alvin Hellerstein sentenced him to fifteen months and proposed restitution of three times that sum, delaying it so that AOL could try to prove greater losses.
Trustworthy Outsourcing
On 10 June 2004 Nasscom, the association of India's software and services companies, said it would work with customers, regulators and law enforcers to build what it called trustworthy outsourcing. The industry had exported $12.5 billion of software and services in the year to March, up more than 30 per cent, and back-office work had brought in $3.6 billion and 245,000 jobs; the worry was that data protection would become a reason to keep such work at home. Legislation might come, said Kiran Karnik, Nasscom's president, but the industry did not mean to wait for it. Nasscom would encourage companies to share information about back-office staff, create a certification authority, take the gaps in Indian law to talks with Europe and the United States, and copy in other cities the cyber laboratory it had set up for the police in Mumbai.
India had no specific data protection act, Sunil Mehta, a vice-president, acknowledged, but six laws, he said, met about 98 per cent of the requirements; a survey Nasscom had commissioned found Indian companies had rarely faced data-security problems, and Karnik said no major virus had been traced to India. Those were the industry's own claims. The plans took years. Sharing information on staff returned as the National Skills Registry in January 2006; more police cyber laboratories backed by the industry followed in other cities; and Karnik sat on the expert committee of 2005 whose proposed duty of reasonable security became Section 43A in October 2009. A data protection law came nineteen years later: the Digital Personal Data Protection Act of 2023, whose remaining provisions take effect in May 2027.
Caltech's 101 categories and an evolved antenna
At CVPR, the computer-vision conference that opened in Washington on 27 June 2004, a workshop paper by Fei-Fei Li, Rob Fergus and Pietro Perona asked how few pictures a machine needed to learn a new kind of object. No published algorithm, they noted, had been tried on more than a handful of categories; theirs, which learnt incrementally and drew on categories learnt before, was tested on 101 widely varied ones, from a collection of 9,146 pictures assembled at Caltech the previous September. Li began work on ImageNet two years later, and its 2012 challenge fell to a deep convolutional network. The same week, at GECCO, the evolutionary-computation conference in Seattle, the first Humies were awarded: cash prizes for evolved results that could stand comparison with human work. Gold went to Lee Spector of Hampshire College, for quantum-computer programs found by genetic programming, and to a NASA Ames team for an evolved antenna, which flew when the Space Technology 5 mission was launched on 22 March 2006.
Network Associates becomes McAfee; Cisco ships admission control
On 30 June 2004 Network Associates announced that it had become McAfee, Inc. The company had been formed in 1997, when McAfee Associates merged with Network General, maker of the Sniffer network analyser; now Sniffer was going to Silver Lake Partners and Texas Pacific Group, who revived the Network General name for it, and George Samenuk, the chairman and chief executive, spoke of “a strategic turning point”. Intel agreed to buy McAfee in August 2010 and in 2017 sold a majority stake to TPG, as Texas Pacific Group had become. On 21 June Cisco released the first phase of Network Admission Control, for its routers: free Trust Agent software on each PC told the network what its anti-virus client reported, and the network decided whether to let the machine in. Network Associates, Symantec and Trend Micro were the scheme's co-sponsors, and on 7 June Cisco had agreed to put Trend Micro's worm and virus signatures into its intrusion-detection software.
⏳ Time capsule — June 2004
- On 8 June Venus crossed the face of the Sun for a little over six hours, a transit seen whole from Europe, most of Asia and almost all of Africa; no one alive had seen the previous one, in December 1882.
- On 15 June the Detroit Pistons beat the Los Angeles Lakers 100–87 at The Palace of Auburn Hills to take the NBA Finals four games to one, as underdogs against a side with Shaquille O'Neal, Kobe Bryant, Karl Malone and Gary Payton; Chauncey Billups was named the Finals' most valuable player.
- On 21 June Mike Melvill, alone aboard SpaceShipOne after its release from the carrier aircraft White Knight over Mojave, California, climbed to 100,124 metres, just past the 100-kilometre line, in the first privately funded human spaceflight, despite a roll caused by wind shear soon after the rocket lit.
- On 30 June Sam Raimi's Spider-Man 2 opened in the United States; it took more than $180 million in its first six days and won the Academy Award for visual effects.
What the Footer Started
Turning ordinary websites into a delivery system for browser exploits became a standard way to reach people who did nothing but read: in April 2007 Google's engineers found about 450,000 of 4.5 million URLs they examined launching drive-by downloads, and that June a hidden frame at the foot of thousands of Italian pages passed visitors to MPack. The advice came back with it. Germany and France told their citizens to use a different browser in January 2010, and in January 2013 the same American team told the public to consider switching Java off. Microsoft ended support for Internet Explorer 11 on the regular releases of Windows 10 on 15 June 2022, eighteen years less nine days after the Storm Center's question mark, and disabled it permanently on 14 February 2023.
Cabir was the first of a line that learned to make money: Symbian trojans that billed their owners by premium-rate text (May 2007), then a Symbian companion to the Zeus banking trojan that forwarded its victims' text messages (October 2010). The insider who sold AOL's list had successors too: the database administrator at Certegy who sold its records (July 2007), the Trend Micro employee who sold an estimated 68,000 customer records to a phone-scam operation (November 2019), the bribed support agents at Coinbase (May 2025). AOL's members met their data again in the search logs it published in August 2006 and the intrusion it confirmed in April 2014.