On Tuesday 14 September 2004 Microsoft published security bulletin MS04-028 and rated it Critical. An unchecked buffer in the code that decoded JPEG images, part of the graphics library GDI+, let a specially crafted picture run a program with the rights of whoever was logged on. Looking was enough: a web page in Internet Explorer, an HTML message in the preview pane of Outlook or Outlook Express, an image inside an Office document, a file previewed in Windows Explorer. Nick DeBaggis had reported the flaw privately, and Microsoft had seen no proof-of-concept code. Windows XP and Windows Server 2003 carried it; Windows 2000 and XP's new Service Pack 2 did not — unless an affected program had brought a vulnerable copy along.
That proviso was the real difficulty. The vulnerable code also shipped inside Office XP and 2003, Project, Visio, Visual Studio .NET and Picture It! — more than a dozen Microsoft products by the bulletin's own list — and other companies' programs carried their own copies of the library, gdiplus.dll, which the Windows patch could not reach. The bulletin conceded that the mere presence of the file did not make a program vulnerable, and set out a table of the versions that did. Windows Update sent users on to Office Update, then to a tool for imaging and development programs. On 23 September the SANS Internet Storm Center released its own scanner, written by Tom Liston; one reader found a vulnerable copy among his Hewlett-Packard CD and DVD software, still flagged after he applied the old patch HP suggested.
Exploit code followed the patch. By 17 September the Storm Center had seen at least two examples of concept code, and one of its handlers, Marcus Sachs, thought a worm or mass-mailer could appear by the end of the month. On 22 September came code that opened a command prompt; by 25 September, a kit that built booby-trapped JPEGs, though handlers found it worked poorly. On the evening of 26 September, Pacific time, a message from Easynews, a Usenet provider, warned Bugtraq that pictures posted by a single sender to several newsgroups, adult ones among them, carried the exploit. Readers who examined them found that on an unpatched machine they fetched files from an FTP site, since taken down, and installed a trojan that called back to its maker.
By 28 September messages on AOL Instant Messenger were urging “Check out my profile, click GET INFO!”, pointing to profiles that, the Storm Center suspected, carried the exploit. None of it became the epidemic forecast. The newsgroup pictures could not spread themselves — “It's not a virus,” one Bugtraq reader replied to the first alarm — and the Storm Center, which never obtained the instant-message pictures, allowed that its detections might be false positives. On 4 October Kaspersky Lab, publishing its chart of September's viruses, said it had seen no malware exploiting the flaw, “despite dire predictions by some analysts that an outbreak was inevitable”. Microsoft revised the bulletin into December, and the single update service the episode had argued for arrived as Microsoft Update, announced in beta in February 2005 and released that June.
The Lock and the Pen
On 14 September 2004 the weblog Engadget, on a tip from the community site MetaFilter, opened a Kryptonite Evolution 2000 U-lock with a Bic ballpoint pen and posted the video. The lock cost $50 and was sold for bicycles left in “moderate to high crime areas”; its tubular cylinder yielded to the hollow shaft of a pen of matching diameter. Within days cyclists were posting videos of themselves opening their own locks, and bicycle shops were taking the locks off their shelves. Kryptonite, owned since 2001 by Ingersoll-Rand, first offered free upgrades that depended on when a lock had been bought. On 22 September it promised to exchange its tubular locks free, starting within a few weeks as new ones were made. “We decided to simplify and expand our planned product upgrade program,” said its general manager, Steve Down; the company wanted to “eliminate any lingering doubt” in its customers' minds. The disclosure had come as a video rather than an advisory, and the maker's answer changed within eight days. Its locks moved to disc cylinders, which a cylindrical object cannot defeat.
The Position, Not the Person
Amit Yoran resigned on Thursday 30 September 2004, reportedly with a day's notice. Since September 2003 he had been the first director of the National Cyber Security Division at the Department of Homeland Security; the division had set up the US Computer Emergency Readiness Team. He said he had always meant to stay only until the division's core objectives were met, and that he was leaving to spend time with his family and pursue charitable interests. Industry executives and former officials pointed to the rank. He answered to an assistant secretary, Robert Liscouski, who answered to an under secretary, Frank Libutti — three levels below the secretary, Tom Ridge — and industry groups and some lawmakers had pressed, without success, to raise the post to assistant secretary. Paul Kurtz of the Cyber Security Industry Alliance called the resignation unfortunate and said the department needed to show more leadership, as Yoran's deputy, Andy Purdy, became acting director. The case for raising the post to assistant secretary outlasted Ridge: his successor, Michael Chertoff, announced one in July 2005, and Greg Garcia became the first to hold it, in 2006.
A Passport for a Reference
On 21 September 2004, at Gartner's IT Security Summit in London, a panel on the security of offshore work turned to India, as it was reported at the time. Its moderator, Partha Iyengar of Gartner India, said the country was seen as an answer for outsourcing applications but as a problem for security, less for its technology than its customs: in a close-knit society, he suggested, reading a colleague's e-mail was not thought much of an intrusion. R. K. Raghavan, a former director of the Central Bureau of Investigation who advised Tata Consultancy Services on security, described what his company had changed. Hiring in volume, it had asked each applicant for two references and had not checked criminal records, and it had found fingerprinting unwelcome to recruits. So it began requiring an Indian passport, which was issued only after screening by the police — in effect handing its background checks to the local police.
Raghavan said the company was going to great lengths on security, chiefly for its American customers. Another panellist told clients to inspect in person any outsourcing centre they used, and a client's architect admitted that buyers went in naive. The cases that tested such checks came within a year — the arrests in Pune over money taken from Citibank customers' accounts (April 2005) and The Sun's claim to have bought British bank customers' details from a worker in Delhi, which he denied (June 2005).
Europe's open humanoid and Fujitsu's office robot
On 1 September 2004 RobotCub began: an integrated project, coordinated from the University of Genoa, to which the European Commission's cognitive-systems programme gave €8.5 million. It was to build a humanoid shaped, in the project's own description, “physically and mentally, like a human child”, designed as an open system, and to study through it how cognition develops in infancy; about a quarter of the money was reserved for copies of the robot for other laboratories. CoSy, a sister project on cognitive assistants led by Sweden's Royal Institute of Technology, started the same day. On 13 September Fujitsu Laboratories and Fujitsu Frontech showed a prototype service robot, 1.3 metres tall, that followed a stored map, steered round obstacles with three-dimensional vision, escorted visitors into lifts, pushed parcel carts and patrolled buildings at night; it went on sale in Japan, in limited numbers, as enon a year later. RobotCub's iCub, the size of a child of three or four, was licensed under the GPL and given free to seven laboratories through an open call.
Symantec buys @stake; California enacts a spyware law
On Thursday 16 September 2004 Symantec agreed to buy @stake, a security consultancy of some 115 people in Cambridge, Massachusetts, which in January 2000 had taken in the hacker collective L0pht Heavy Industries. Terms were not disclosed. Its customers, the announcement said, included six of the world's top ten financial institutions, and Chris Wysopal, a L0pht veteran, was to stay on; Dave Aitel, a former @stake consultant, found the sale a little surprising but “the way things are going”. On 28 September Governor Arnold Schwarzenegger signed California's Consumer Protection Against Computer Spyware Act, which barred anyone but a computer's authorised user from planting software on it that deceptively changed browser settings, logged keystrokes or resisted removal. The Privacy Rights Clearinghouse and the World Privacy Forum had urged a veto, arguing that industry amendments and a demanding test of intent had hollowed it out, and the researcher Ben Edelman called the law toothless. Symantec later stopped selling @stake's password auditor, LC5, and in January 2009 its original authors, Wysopal among them, bought L0phtCrack back.
⏳ Time capsule — September 2004
- On 13 September Oprah Winfrey opened the nineteenth season of her talk show by giving each of the 276 people in her studio audience a new Pontiac G6, donated by the carmaker; they had been chosen because family and friends had told the show's producers they needed a car.
- On 20 September the first operational flight of India's Geosynchronous Satellite Launch Vehicle lifted EDUSAT from Sriharikota: a 1,950-kilogram satellite, the first India had built exclusively to serve education, meant above all for interactive distance learning by satellite. It was moved to a graveyard orbit in September 2010.
- On 21 September Reprise Records released Green Day's American Idiot, a concept album the band called a punk rock opera, following an anti-hero it named Jesus of Suburbia. It entered the Billboard 200 at number one, the band's first American chart-topper, with 267,000 copies sold in its first week, won the Grammy for best rock album, and reached Broadway as a musical in April 2010.
- On 22 September ABC broadcast the first part of the pilot of Lost, directed by J. J. Abrams, who wrote it with Damon Lindelof. At an estimated $10 million to $14 million, much of it spent on a decommissioned Lockheed L-1011 dressed as the wreckage of Flight 815, it was the most expensive pilot made to that time; 18.6 million viewers watched.
After the Picture
Pictures kept running code. Fifteen months on, a flaw in Windows Metafiles was being exploited before Microsoft patched it (January 2006); animated cursors followed (April 2007), then Android's media library, Stagefright (July 2015), and FORCEDENTRY, whose fake GIFs reached iPhones through iMessage without a tap (September 2021). The harder half of MS04-028 — finding every copy of a flawed component — returned at far greater scale with Log4Shell (December 2021), a flaw in Log4j, a logging library embedded in software beyond counting. In 2004 US-CERT's advice had been to search the system for a single file name, “gdiplus.dll”.
The argument over rank outlived Yoran's departure. Rod Beckstrom, who ran the department's National Cyber Security Center, resigned in March 2009, writing that the centre had been funded for only five weeks of the past year, and in November 2018 the department's National Protection and Programs Directorate became the Cybersecurity and Infrastructure Security Agency. Yoran went on to run NetWitness, where February 2010 finds him, then RSA and Tenable; he died in January 2025, aged 54. Kryptonite now belongs to Allegion, the security business Ingersoll-Rand spun off in 2013, and the lesson of its lock still holds: a flaw shown on video is disclosed to everyone at once.