Early on Saturday 20 November 2004 some of the banner advertisements on The Register, the British technology news site, began trying to break into its readers' computers. They came from Falk eSolutions, a German company whose AdSolution Global service delivered banners to The Register and other sites. Falk later traced the trouble to “a hacker attack on one of our load balancers”, the machines that shared out incoming requests among its ad servers. Through a weakness in that model, about every thirtieth request for a banner was answered with a redirect to a compromised website, which sent back a file that tried to run an exploit for Internet Explorer. The Register suspended Falk's service as soon as it found the problem.
The flaw had been public for less than a month. On 23 October a poster using the name ned put on the Full-Disclosure mailing list a Python port of mangleme, a fuzzer that feeds a browser malformed pages to see what breaks; within about three hours it found bugs in Internet Explorer. Within a day Berend-Jan Wever, known as SkyLined, reported that one of them, an overflow in the SRC and NAME properties of the IFRAME tag, could be exploited, and reckoned a reliable exploit would take no more than a day to write. On 2 November he published one, whose JavaScript prepared the browser's memory before the overflow fired. Internet Explorer 6 was vulnerable on every version of Windows except Server 2003 and XP with Service Pack 2.
Attackers needed less than a week. By 8 November a family of worms that anti-virus companies called Bofra, or MyDoom.AG and AH, was mailing links instead of attachments, dressed up as pictures from an adult webcam or a PayPal order confirmation. Each pointed to a small web server on the machine that had sent it, which served the exploit to whoever clicked; infected machines then took orders over IRC. US-CERT issued an alert on 10 November. On the 20th the SANS Internet Storm Center, told first of a “high profile UK website”, heard of more in Sweden and the Netherlands, suggested that advertising servers rather than the sites themselves carried the exploit, and guessed that hundreds of sites might be affected. No count of infected readers was published.
The Register told anyone who had visited between 6am and 12.30pm GMT that Saturday to scan their machines, install Service Pack 2 if they ran Windows XP and consider another browser until Microsoft fixed the flaw, and apologised for a problem it said was beyond its direct control. In an explanation The Register published on the Monday, Falk said it had fixed the fault within six hours of being told. With Microsoft's next scheduled updates due on 14 December, the Storm Center advised users of Internet Explorer 6 to switch browsers in the meantime. Microsoft did not wait. On 1 December it published MS04-040, a critical cumulative update for Internet Explorer, acknowledging that the flaw had been publicly disclosed and was already being exploited.
Nine Years, Recommended
Early in November 2004 a jury in Leesburg, Virginia, convicted Jeremy Jaynes of Raleigh, North Carolina, on three felony counts of sending bulk email with falsified routing information through America Online's servers in Virginia, and recommended nine years in prison, in what prosecutors called the country's first felony prosecution of spammers. By their account he sent some 10 million messages a day over sixteen high-speed lines, selling a “FedEx refund processor”, penny-stock tips and software, and grossed up to $750,000 a month; his AOL addresses, they said, matched the list of 92 million an AOL engineer had been charged with stealing in June. The judge dismissed his sister's conviction; a third defendant was acquitted. On 8 April 2005 Judge Thomas Horne imposed the nine years, delayed pending appeal. The Court of Appeals upheld the conviction, and so, by four votes to three, did the Supreme Court of Virginia on 29 February 2008; on rehearing, on 12 September 2008, it unanimously struck the law down, as the defence had urged, for reaching anonymous political and religious mail too. The US Supreme Court declined the state's appeal in March 2009.
Make Love Not Spam
By 26 November 2004 Lycos Europe had begun handing out a screensaver for Windows and Mac OS called Make Love Not Spam. While a computer sat idle, it requested pages from websites advertised in spam, chosen by hand from sources including SpamCop, on the theory that sites which sold no advertising paid for their own bandwidth and would feel the cost; a Lycos spokesman in Germany put each copy's traffic at about 3.4MB a day. Lycos said it ran tests to make sure that no target server stopped working. Critics called it a denial-of-service attack all the same, and Bruce Schneier called it “vigilante justice”, warning that those who counter-attacked would in turn be attacked. Within days there were reports of targeted sites overwhelmed and of counter-attacks on the campaign itself. Early in December, about a week after the launch, Lycos Europe ended the campaign and switched off the screensavers already installed.
A First Under Section 67
On 5 November 2004 the Additional Chief Metropolitan Magistrate at Egmore, in Chennai, convicted a man in the case that bears his name, State of Tamil Nadu v. Suhas Katti, in what has since been regarded as the first conviction under section 67 of the Information Technology Act of 2000, which punished publishing obscene material in electronic form. The woman he targeted had known him as a family friend and had refused to marry him. He posted obscene and defamatory messages about her in Yahoo message groups, which brought her calls from strangers who believed she was soliciting, and forwarded to her mail that arrived at an account he had opened in her name. She complained in February 2004; police traced him to Mumbai and arrested him within days, and filed the charge sheet on 24 March.
The defence argued that someone close to her, or she herself, had sent the messages to implicate him, and that some of the documentary evidence fell short of section 65B of the Indian Evidence Act, which governs electronic records. The magistrate relied on expert witnesses and on cyber café owners, and passed sentence: two years' rigorous imprisonment and a ₹4,000 fine under section 67; two years and ₹500 under section 469 of the Penal Code, forgery to harm a reputation; and one year's simple imprisonment and ₹500 under section 509, insulting a woman's modesty, the terms to run together. He paid the fines and was taken to the Central Prison in Chennai, about nine months after her complaint. Three weeks later a listing on Baazee.com began the case told in May 2008.
Blue Gene/L displaces the Earth Simulator
On Monday 8 November 2004, at the SC2004 conference in Pittsburgh, the 24th TOP500 list of the world's fastest computers put IBM's Blue Gene/L first, at 70.72 teraflops on the Linpack benchmark, with NASA's Columbia second and Japan's Earth Simulator, first on the previous five lists, third. The winner, a beta system of 32,768 processors, was bound for Lawrence Livermore National Laboratory. IBM had begun Blue Gene in December 1999 as a $100 million research effort aimed at protein folding, and built Blue Gene/L from 700MHz embedded processors that traded speed for low power. A Blue Gene was chosen in June 2005 for Lausanne's Blue Brain Project, and Blue Gene/L, enlarged three times, stayed first for seven lists, until Roadrunner passed it in June 2008. On 15 November ScanSoft agreed to buy three speech companies for about $63 million before earn-outs: Phonetic Systems, for directory assistance; ART, for speech and handwriting recognition on mobile devices; and Rhetorical Systems of Edinburgh, for text-to-speech. The next May it agreed to merge with Nuance, whose name it took that October.
Trend Micro's new chief and a retrospective test
On 5 November 2004 Trend Micro, the Tokyo-based anti-virus company, split the posts of chairman and chief executive, naming Eva Chen, a founder in 1988 and its technology chief since 1996, to run it from 1 January 2005; Steve Chang, who had held both posts, would remain chairman. The company credited Chen with InterScan VirusWall, which it called the first anti-virus product for the internet gateway. In a report dated November 2004, Andreas Clementi of AV-Comparatives, in Austria, set thirteen scanners, left with their signatures of early August, against 6,145 samples received in the three months to 6 November, most of them backdoors rather than worms. ESET's NOD32 caught 49 per cent, Kaspersky 43, Symantec 19 and Trend Micro 4, the only product left unrated. Clementi allowed that vendors' claims of proactive detection “far higher than those reached in this test” could hold on other samples, and judged any of the thirteen, kept up to date, safe to use. Chen was still chief executive in 2026; the laboratory published its first test against live attacks in December 2009.
⏳ Time capsule — November 2004
- On 9 November Mozilla released Firefox 1.0. The launch came with a campaign, organised by the browser's users, to run a full-page advertisement in The New York Times.
- On 20 November the Museum of Modern Art in New York reopened on West 53rd Street after an expansion designed by Yoshio Taniguchi that took its exhibition space from 85,000 to 125,000 square feet; entry was free that day, and afterwards cost adults $20.
- On 23 November World of Warcraft went on sale in North America and Australia, ten years after the Warcraft series began; Europe followed in February 2005, and at its peak, in October 2010, the game had 12 million subscribers.
- On 29 November the 35th International Film Festival of India opened in Goa, the first edition held at its new permanent venue, with Mira Nair's Vanity Fair; it ran until 9 December.
The Route That Stayed
The flaw was closed; the method used against it was not. Filling a browser's memory with JavaScript before triggering the bug, as Wever's exploit did, is known as heap spraying, and from the summer of 2005 it was in wide use in attacks on Internet Explorer. Microsoft broke its patch schedule again for a flaw in Windows metafiles in January 2006 and for the attack Google disclosed in January 2010, and retired the Internet Explorer desktop application in June 2022. The route outlasted the browser. Advertising delivered to a trusted site from machines it did not control became a standing way to reach that site's readers, as the New York Times found in September 2009.
Virginia's statute fell; the federal CAN-SPAM Act, which is aimed at commercial mail, did not share its flaw. Answering spam in kind fared no better than Lycos had: Blue Security's Blue Frog, which replied to every spam with a complaint to the advertised website, was shut down after a flood aimed at the company in May 2006. The Chennai conviction is still cited as section 67's first, and Indian law has since named more of what was done there: stalking, including the monitoring of a woman's use of the internet, became an offence in February 2013, and in January 2022 a fake online auction of more than a hundred Muslim women led to arrests within days.