At about 8:45 on the evening of Friday 19 March 2004, Pacific time — 04:45 GMT on the Saturday — the network telescope of CAIDA at the University of California, San Diego, which watches about a 256th of the internet's addresses, logged a new worm's first packet. The worm was that single UDP packet, aimed at the security software of Internet Security Systems: the BlackICE personal firewall and the RealSecure intrusion-detection products, whose protocol-analysis module treated any UDP packet from port 4000 as ICQ instant-messaging traffic and could be overflowed by one. eEye Digital Security had found the flaw on 8 March; eEye and ISS published it on Thursday the 18th. Within ten seconds 110 machines were infected, within thirty 160; no known worm, CAIDA concluded, had followed a disclosure faster.
Unlike the mass-mailers whose authors were trading insults in new variants that month, a war February 2004 recounts, Witty needed nobody to open anything. It was under 700 bytes, its working body 177 instructions in 474 bytes, and Nicholas Weaver and Dan Ellis, writing in June, found no significant bugs. On each machine it sent 20,000 copies to random addresses and ports, then picked one of the machine's physical disks, wrote 64 kilobytes taken from the start of the very module it had broken into over a random spot, and began again until the machine crashed. A reboot cleared the worm, which lived only in memory, but not the damage. Just before the overwriting code sat the phrase that named it: “(^.^) insert witty message here (^.^)”.
The count that has lasted is CAIDA's. Its analysts, Colleen Shannon and David Moore, put the infected population at about 12,000 hosts at most, the majority reached within about 45 minutes and together sending more than 90 gigabits a second — over 11 million packets — at the peak. Twelve hours in, half had gone quiet. Weaver and Ellis read the timeline, the code and the payload as the work of an author who was motivated, sophisticated, skilled and malicious, and called the worm a dangerous new trend that combined skill with malice. Every machine it reached had been running software bought to secure a network.
The puzzle outlived the worm. In 2005 Abhishek Kumar, Vern Paxson and Weaver rebuilt the outbreak from its random-number generator and found a likely Patient Zero: a host at a European retail ISP, running a launch tool rather than the worm, whose address they passed to law enforcement. They cautioned that an author could as easily hide behind a chain of compromised machines used as stepping stones; leaving Patient Zero running, they wrote, had been purely a mistake. The team read 110 early victims at a single US military installation as a hit-list. On the tenth anniversary Robert Graham, who had created BlackICE, argued that they were Army sensors on Fort Huachuca's addresses, each watching a whole link's traffic, so no list was needed. There the public record stops.
Six Suits at Once
On Wednesday 10 March 2004 America Online, EarthLink, Microsoft and Yahoo!, rivals that said they had shared information, resources and investigative practices, announced at a news conference in Washington six lawsuits against hundreds of alleged spammers, filed in federal courts in California, Georgia, Virginia and Washington state. They were, as Microsoft put it, the first major industry lawsuits against accused spammers, brought under the CAN-SPAM Act, in force since 1 January, which let internet providers sue (January 2004 sets out its terms). Many defendants were known only as John Does, accused of promoting prescription drugs, mortgage leads, adult websites and a weight-loss patch; AOL named two men whose mail, it said, had sold weight-loss supplements and hand-held “personal lie detectors”. “Congress gave us the necessary tools to pursue spammers with stiff penalties, and we in the industry didn't waste a moment,” said Randall Boe, AOL's general counsel. Collecting proved slower. AOL won a default judgment of $12.8 million against one of the two, and in August 2006 announced that it would dig on his parents' land for the gold and platinum he had boasted of burying.
Letters Under the Law
From mid-March 2004, by the accounts published at the time, San Diego State University wrote to more than 178,000 students, alumni and employees. Intruders had got into a server in its financial-aid office, a machine holding names and Social Security numbers, and had used it, the university said, to send spam and store files of their own; once the intrusion was found, in February, the server was taken offline. The university said it had no sign that the access had been used for identity theft, but it wrote to everyone on the server all the same. A California law in force since July 2003 required such letters whenever unencrypted personal information was reasonably believed to have been taken, and the San Diego mailing was reported as among the largest yet made under it. Most of the country had no such law, so a break-in that would have gone unannounced elsewhere became 178,000 envelopes.
An Extended LAN
On Monday 22 March 2004 the computer supplement of The Tribune, in Chandigarh, explained how many Indians reached the internet. “Actually cable Net in India is basically an extended LAN over Cat5 cable,” wrote Inderjeet Singh Sodhi: not data over television coaxial but an office-style network, cheap and stable. That, he warned, “opens the doors to security risks that are usually prevalent in the corporate world” — computers left on with messengers running, anti-virus data files updated but seldom the core files, a search engine that had used a hole in Internet Explorer to download files unasked and reset the default search page. His answer was patches and a firewall, a gatekeeper he reckoned removed about two-thirds of the risk, with file and print sharing switched off on the network card facing the provider; providers, he added, should tell customers of the risks and help them. That weekend Witty had shown a firewall could also be the way in.
The national response team wrote for administrators. CERT-In's advisories that month covered a flaw in Outlook's handling of mailto links, fixed in Microsoft's MS04-009 (11 March, rated high); three flaws in OpenSSL reported by Britain's NISCC and the OpenSSL Project (19 March); and exploit code published for nine known Cisco flaws, most leading, it said, to denial of service and one to “router takeover” (31 March). None of the three concerned ISS's products; home users on a shared cable had columns like Sodhi's, and a duty to report incidents to CERT-In lay eighteen years ahead (January 2004).
No vehicle finishes DARPA's first Grand Challenge
On Saturday 13 March 2004 DARPA, the Pentagon's research agency, sent driverless vehicles from Barstow, California, towards Primm, Nevada, in its first Grand Challenge, offering $1 million to the first to finish inside ten hours. Fifteen had come through qualifying trials at the California Speedway in Fontana that week, and the route, some 2,200 GPS waypoints on a CD-ROM, was handed out about two hours before the start. None came close. Carnegie Mellon's Sandstorm, a red 1986 Humvee entered by William “Red” Whittaker's team, went farthest, about 7.4 miles, before it lodged on a rock at a hairpin in the hills and spun its front tyres until the rubber burned off. A pickup entered by David Hall, founder of the subwoofer maker Velodyne, came third. Anthony Tether, DARPA's director, called the day “a most important first step in a long journey”. Five vehicles finished the second race, in October 2005; Velodyne's spinning 64-laser scanner later guided five of the six finishers of DARPA's 2007 race, and Google's first driverless prototype used one.
Utah enacts the first state spyware law
On 23 March 2004 Governor Olene Walker signed Utah's Spyware Control Act, passed on 3 March and reported as the first state law aimed at spyware. It defined spyware broadly, as software that monitored a computer's use and reported on it without the owner's consent, forbade installing it on another person's machine and outlawed pop-ups, triggered by the page being viewed, that covered a website's own content or advertising; owners of websites, trademarks and copyrights could sue for at least $10,000 a violation. AOL, Google, Microsoft, Yahoo! and others had asked her to veto it, as had the Center for Democracy and Technology, and on a challenge from the adware company WhenU a Salt Lake City judge halted the law in June. On 29 March Check Point Software Technologies announced that it had completed its purchase of Zone Labs, maker of the ZoneAlarm firewall and, in Check Point's words, “the market leader in endpoint security”, for about $114 million in cash and 5.3 million shares; nineteen years later it paid $490 million for Perimeter 81 (August 2023).
⏳ Time capsule — March 2004
- On 24 March the European Commission fined Microsoft €497 million, the largest penalty it had yet imposed on a company for breaking competition law, and ordered it to offer a version of Windows without Media Player and to disclose what rival servers needed to work with Windows; the Court of First Instance upheld the decision in September 2007.
- On 27 March France beat England 24–21 before 79,906 spectators at the Stade de France to complete the Six Nations Grand Slam, their eighth, and leave the world champions third in the table.
- On 29 March Ireland became the first country to ban smoking in all enclosed workplaces, bars, restaurants and clubs among them.
- On 30 March Alistair Cooke died at his home in New York, aged 95, four weeks after announcing his retirement from Letter from America, the talk he had broadcast on BBC radio since 1946 in 2,869 instalments.
The Code That Reads the Attack
Witty went in through the part of a security product that must read whatever an attacker sends, and the CERT Coordination Center's note named the fault plainly: a stack buffer overflow in the code that parsed ICQ replies. The archive keeps returning to that place. eEye and Symantec announced a worm that entered through out-of-date copies of Symantec's corporate anti-virus software (December 2006); Google's Tavis Ormandy found unpackers running in the Windows kernel inside every Symantec and Norton product (June 2016). Then the appliances bought to guard the edge became its weakest point: Barracuda told customers to replace compromised email gateways rather than patch them (June 2023), and federal agencies were ordered to disconnect Ivanti's VPNs (January 2024). In July 2024 a missing bounds check in CrowdStrike's sensor needed no attacker at all to stop some 8.5 million Windows machines.
Witty's other first, in CAIDA's account — the first widely propagated internet worm to carry a destructive payload — returned at scale. Shamoon overwrote the disks of some thirty thousand workstations at Saudi Aramco (August 2012), and NotPetya, a wiper dressed as ransomware, rode an accounting package's updates out of Ukraine (June 2017). The month's quietest story travelled furthest. The letters San Diego State sent under California's law became a national habit once the same law made a data broker, ChoicePoint, write to about 35,000 Californians (February 2005); every state has had a notification law of its own since 2018.