Symantec dates its discovery to Friday 30 April 2004, and it spread over the weekend that followed. Sasser came by no email and waited for no one to click. An infected Windows 2000 or XP machine ran 128 threads probing addresses on TCP port 445; where one answered, it sent code that opened a shell on port 9996 and had the new victim fetch the worm by FTP from port 5554 of the old. The attack crashed LSASS, the Local Security Authority Subsystem Service, and Windows announced that it would shut down in one minute — then did, and on restarting could be hit again. Microsoft's help page suggested that anyone whose computer kept shutting down print its instructions, for themselves or for a friend.
By 4 May the casualties had names. Britain's coastguard lost the electronic mapping at its stations for some hours, and staff went back to paper charts. Taiwan's post office, by press reports, had some 1,600 machines hit and sent hundreds of branches back to pen and paper. In Australia, reports said, Westpac's call centres went dark and RailCorp's trains stopped when drivers lost radio contact with signallers; its chief executive said a virus might be the cause. Finland's Sampo and its insurer If shut 130 offices as a precaution. Delta Air Lines cancelled several transatlantic flights that weekend after computer trouble, and Agence France-Presse lost its satellite communications for hours.
The hole had been known for months. eEye Digital Security reported it to Microsoft on 8 October 2003: a logging routine in LSASRV.DLL handed strings to vsprintf() without checking their length, to write a debug file called DCPROMO.LOG. Microsoft fixed it on 13 April 2004, one of fourteen flaws in MS04-011; exploit code appeared within days, the worm within seventeen. F-Secure published a workaround: a read-only file of that name kept the vulnerable code from running. An unprotected, unpatched Windows PC put on the internet, researchers warned, could be infected within minutes. Estimates of the infected ran from hundreds of thousands of machines into the millions, and no count was ever agreed. And a new Netsky variant carried a boast: its authors, it said, had written Sasser.
The boast was true, and people who knew him gave him away. On Wednesday 5 May informants asked Microsoft about a reward from the $5 million fund it had set up the previous November; on Friday 7 May police raided a home near Rotenburg, in Lower Saxony, and took computers and disks. The suspect, eighteen, confessed to writing and releasing Sasser, and Netsky too. Microsoft said its informants were people who knew who the author was, and had not found him through technical analysis. The court in Verden that tried him gave him a suspended youth sentence in July 2005.
A Portion of the Code
In mid-May 2004 part of the source code of IOS, the operating system that ran Cisco's routers, was copied from the company's network and posted on the internet. SecurityLab, a Russian security site, reported the theft: some 800 megabytes of IOS 12.3 and 12.3T, it said, with a sample handed over in an IRC channel by someone using a pseudonym. Cisco did not confirm the size. It spoke only of a portion of the code, and said it did not believe the publication put customers' networks at greater risk. In May 2009 an indictment in California charged a Swedish man, a juvenile in 2004, with five felonies: entering Cisco's network that May and taking IOS code, and intrusions at NASA, among them its Ames Research Center the same month. In February 2010 American prosecutors transferred the case to Sweden, where he had already received a conditional sentence for other intrusions of the period; how the new charges ended is not in any record this edition could find.
The AOL Billing Center
On Monday 17 May 2004 Judge Vanessa D. Gilmore of the federal court in Houston sentenced Zachary Keith Hill, 20, to forty-six months in prison for phishing. His spam came from a “billing center” or “account department”, under subject lines such as “AOL Billing Error Please Read Enclosed Email” and “Please Update Account Information Urgent!”; one warned that “your account will be revoked and put under review and may be cancelled”. Its link led to Hill's own copy of the AOL Billing Center, where recipients typed in names, Social Security numbers, card and bank details and AOL logins. A PayPal version worked the same way, and he used the passwords to buy through victims' accounts. By the Justice Department's count he collected 473 credit card numbers, 152 sets of bank account and routing numbers and 566 user names and passwords, and spent more than $47,000 with the cards. He had pleaded guilty on 9 February to possessing access devices with intent to defraud and using them to defraud people of nearly $50,000; the Federal Trade Commission, suing him separately, had won a preliminary injunction against the scheme in December 2003.
One Letter More
On 6 May 2004 the Supreme Court of India ruled in Satyam Infoway Ltd. v. Siffynet Solutions Pvt. Ltd. Satyam Infoway, which traded under the coined word Sify, had registered domain names including sifynet and sifymall.com in June 1999. From 5 June 2001 Siffynet Solutions sold internet marketing under siffynet.net and sijfynet.com, a name it said came from the first letters of its five promoters; the Court called that “an invented post-rationalisation”. Satyam sued for passing off and won a temporary injunction in the City Civil Court; the High Court set it aside. Before the Supreme Court the respondent argued that a domain name was merely an address on the internet, and that registering one with ICANN conferred no intellectual property.
Justice Ruma Pal, writing for herself and Justice P. Venkatarama Reddi, disagreed. “With the increase of commercial activity on the internet, a domain name is also used as business identifier,” she wrote, and one “may have all the characteristics of a trademark and could found an action for passing off.” A user looking for Satyam's services might “put in that extra 'f' and be disappointed with the result.” She noted that “there is no legislation which explicitly refers to dispute resolution in connection with domain names”, and that the Trade Marks Act did not reach beyond India, and restored the injunction on a prima facie view that evidence at trial might change. The doctrine travelled: ten months later the Delhi High Court, finding no Indian law on phishing, held that phishing was passing off too (March 2005).
Congress's auditors count 199 data-mining efforts
On 27 May 2004 the General Accounting Office, Congress's auditors, made public a census of pattern-finding in the federal government. Asked by Senator Daniel Akaka, it had surveyed 128 departments and agencies; 52 said they used or planned data mining, which it defined as statistical analysis and modelling that uncover hidden patterns and infer rules for predicting future results, much of what would now be called machine learning. They reported 199 efforts, 131 running and 68 planned, and 122 used personal information. Congress had cut off the Pentagon's Total Information Awareness programme some eight months before. The same week Microsoft made its Intelligent Message Filter, an add-on for Exchange Server 2003 first promised only to customers with Software Assurance contracts, a free download for every Exchange 2003 customer. Its SmartScreen technology, from Microsoft Research, had learned from millions of messages that hundreds of thousands of Hotmail users volunteered to classify; the name later passed to the filter that Internet Explorer, and then Windows, turned against malicious sites and downloads (October 2006).
Symantec buys Brightmail; Sybari files to go public
On 19 May 2004 Symantec agreed to buy Brightmail, a San Francisco maker of anti-spam software, for about $370 million in cash. Spam, said John W. Thompson, Symantec's chairman and chief executive, was now “topping viruses as the number one problem plaguing email systems”. Brightmail watched for new campaigns through its Probe Network, more than a million decoy addresses left where spammers would collect them, and sent customers updates about every ten minutes; it counted over 300 million mailboxes under subscription, and some 15 of the 20 major American internet providers as customers. It had filed to go public on 22 March; its board and stockholders preferred the sale. Symantec, an investor since July 2000, already supplied the engine in Brightmail's anti-virus product. Five days before the deal Sybari Software, whose Antigen ran several vendors' scanning engines on Exchange and Lotus Domino servers, filed for an offering of its own; it was still private when Microsoft agreed to buy it in February 2005. Brightmail's chief executive, Enrique Salem, came with the deal and ran Symantec from April 2009.
⏳ Time capsule — May 2004
- On 1 May Cyprus, the Czech Republic, Estonia, Hungary, Latvia, Lithuania, Malta, Poland, Slovakia and Slovenia joined the European Union, taking it from fifteen members to twenty-five, under the Treaty of Accession signed at the Stoa of Attalus in Athens on 16 April 2003.
- On 6 May NBC broadcast “The Last One”, the final episode of Friends, watched by 52.5 million Americans by Nielsen's count; the six friends left their keys on the kitchen counter of the emptied apartment.
- On 14 May Crown Prince Frederik of Denmark married Mary Donaldson, an Australian he had met during the Sydney Olympics in September 2000, in Copenhagen Cathedral.
- On 29 May President George W. Bush dedicated the National World War II Memorial on the National Mall in Washington, open to the public since 29 April; its Freedom Wall carries 4,048 gold stars, each standing for a hundred Americans who died in the war.
Seventeen Days
Sasser's margin was seventeen days, and its lesson — that a patch published is not a patch applied — was taught again and again in this archive. Zotob arrived within a week of its fix in August 2005; Conficker came about four weeks after MS08-067 (January 2009); WannaCry ran through a hole Microsoft had closed two months before (May 2017), and NotPetya through the same one six weeks later (June 2017). Microsoft's structural answer came three months after Sasser, when Service Pack 2 switched Windows XP's firewall on by default (August 2004); it has shipped switched on ever since. Its reward was paid for Sasser in July 2005; for Conficker's $250,000, offered in February 2009, no payment is on record.
The other threads ran on. Hill's counterfeit billing page needed only a link and an anxious customer; India's central bank wrote to every commercial bank about such pages in February 2006, and in October 2006 Internet Explorer 7 and Firefox 2 arrived with built-in warnings against reported fraudulent sites. The Supreme Court's extra 'f' became the lookalike domain, a hyphen or a single character from the real one, that the FBI singled out against business email compromise in August 2015. And the code copied from Cisco's network was an early sign that routers would be targets in earnest: a modified IOS was found on routers in four countries, India among them, in September 2015, and implants on IOS XE devices were counted in the tens of thousands in October 2023.