Microsoft published bulletin MS05-039 on Tuesday 9 August 2005. It fixed an unchecked message length in the Plug and Play service, a flaw reported privately by Neel Mehta of ISS X-Force, and was rated Critical only for Windows 2000, on which “an anonymous attacker could remotely try to exploit this vulnerability”; on XP Service Pack 2 and Server 2003 an attacker first had to log on. Microsoft had seen no exploit code. By Thursday 11 August there was some, published by researchers, and on Friday the SANS Internet Storm Center raised its alert level to yellow. Over the weekend of 13 and 14 August the first worm to use it, which F-Secure named Zotob, began scanning for machines listening on TCP port 445 — a port the bulletin had advised blocking.
Judging the situation static, most exposed machines probably already taken, the Storm Center lowered its alert to green on the night of 15–16 August. On Tuesday 16 August new variants appeared, and Windows 2000 machines in large organisations began restarting over and over. At 5.57 p.m. Eastern time CNN went to breaking news, and its own systems were part of the story: the anchor, Wolf Blitzer, said the worm was “certainly affecting our computers at CNN in New York, as well as in Atlanta”, and Ali Velshi, reporting from New York, described how “this little notice would come on to tell me that my computer's going to shut down.” ABC and The New York Times were hit; so, the Storm Center's handlers noted that evening, was Capitol Hill.
At about 3 p.m. that Tuesday thirteen DaimlerChrysler plants in six states went offline for five to fifty minutes; eWeek reported that more than 50,000 assembly-line workers stood idle. By 17 August Microsoft's advisory listed ten worms and bots using the flaw, five of them Zotob variants, and said its investigation had found “only a small number of customers have been affected”, with “no indication of widespread impact to the Internet”; homes, rarely running Windows 2000, were largely spared. On Friday 26 August the FBI announced arrests made with help from Microsoft's investigators: in Morocco, Farid Essebar, 18, born in Russia and known online as Diabl0; in Turkey, a 21-year-old known as Coder, who the FBI believed had paid him for the code.
Two endings took a year. On Thursday 18 August the US-VISIT workstations that screened visitors at airports including Los Angeles, San Francisco and Miami had failed, and officers worked by hand; officials blamed a virus, then a routine fault. Documents Wired obtained from Customs and Border Protection in 2006 indicated that Zotob had entered its computers that day, after the patch was held back from about 1,300 US-VISIT workstations for fear of upsetting their fingerprint readers and passport scanners. In September 2006 a Moroccan court sentenced Essebar to two years in prison; how the Turkish case ended is not on any record we could find.
Three Routers in Guangdong
On 25 August 2005 The Washington Post reported, from unnamed officials, that websites in China were being used to attack networks at the Defense Department and other agencies, and had breached hundreds of unclassified networks, in incidents code-named Titan Rain. Time, in a story dated 29 August, told it through a network-security analyst at Sandia National Laboratories who had traced intrusions, after hours, to three routers in Guangdong. Among the files taken, Time said, unclassified but many export-controlled, were papers on the propulsion, solar panels and fuel tanks of the Mars Reconnaissance Orbiter, launched on 12 August. Sandia, which had ordered him to stop, fired him. China's State Council Information Office told Time the charges were “totally groundless, irresponsible and unworthy of refute”, and officials told the magazine they did not yet know whether the spying was directed by a government, by private groups or by independent hackers. In February 2007 a New Mexico jury awarded the analyst about $4.7 million.
Bluetooth in the Stands
From 6 to 14 August 2005 the World Championships in Athletics filled Helsinki's Olympic Stadium, much of the time in heavy rain, and something else worked its way along the rows. Cabir, first reported in June 2004, was a worm for smartphones running Symbian Series 60 that travelled by Bluetooth over about ten metres. It reached a phone as a file the owner had to accept and install, and then drained the battery hunting for the next phone. “At most we are speaking about dozens of infections, but during a short period and in one spot this is a huge number,” Jarmo Koski of the operator TeliaSonera told Reuters that week. Researchers thought many owners had simply tired of the repeated prompts and accepted. F-Secure put staff in the stadium to help visitors clean their phones; Mikko Hyppönen, its director of anti-virus research, wrote that much the same had happened at the Live 8 concerts earlier that summer. Cabir did little worse than flatten batteries. By 2010 a Symbian companion to the Zeus banking trojan was forwarding its victims' text messages.
Reasonable Security Practices
On 29 August 2005 the Press Information Bureau announced that an expert committee set up in January under Brijesh Kumar, secretary of the Department of Information Technology, with Nasscom's Kiran Karnik among its members, had reported on amending the Information Technology Act, 2000. The minister, Dayanidhi Maran, had its proposals posted on the department's website for comment, citing data protection in outsourced work — the cases of April and June — and the liability of network providers. A company negligent in “reasonable security practices and procedures” for “sensitive personal data or information” would owe up to one crore rupees in compensation; video voyeurism and child pornography would become offences; and Section 79, drawing on the European e-commerce directive, would keep intermediaries — auction sites and cyber cafés included — immune unless they conspired in a wrong or, on “actual knowledge” or government notice, failed to remove material expeditiously.
The draft retitled Section 66 from “Hacking with computer system” to “Computer related offenses”, made each offence turn on acting “dishonestly or fraudulently” and graded them by severity, with maximum terms of one and two years against the Act's three: new users who erred “for curiosity”, the summary explained, must not get “scared away”. Parliament's committee argued over the word hacking in January 2007. Much of the rest took effect in October 2009 — the data clause as Section 43A, voyeurism as Section 66E, the intermediary test almost word for word in Section 79 — though Section 66 came out at three years. A duty to secure personal data, with penalties up to ₹250 crore, is written into the 2023 law our India desk sets out, in force in full from 13 May 2027.
Google tops NIST's translation evaluation
On 1 August 2005 the National Institute of Standards and Technology published the results of its 2005 machine-translation evaluation, in which twenty sites translated news articles from Arabic, Chinese or both into English. Google's statistical system, built under Franz Och, came first in all four rankings. With the common training data it scored 0.5131 on Arabic by BLEU, a count of word sequences shared with human translations, against 0.4657 for the University of Southern California's Information Sciences Institute. Systran, whose rules-based technology then powered Google's public translation pages, finished far down both its tables, though NIST noted that commercial developers had generally entered research systems, not products; its chief executive had told The Christian Science Monitor in June: “You don't learn a language with statistical methods.” That evening the Nineteenth International Joint Conference on Artificial Intelligence was formally opened in Edinburgh, the first held in Britain since 1971; its award for research excellence went to Geoffrey Hinton, who had taken his doctorate there in 1978. Google put the system online for Arabic in April 2006.
Symantec buys Sygate in a week of deals
On 16 August 2005 Symantec agreed to buy Sygate Technologies of Fremont, California, on terms it did not disclose. Sygate sold what it called “Compliance on Contact”: software that checked every desktop, laptop, server or mobile device connecting to a corporate network for current security software, correct settings and up-to-date patches, and could keep those that fell short away from chosen resources until they were put right, with a small downloadable agent for kiosks and other machines a company did not own. Symantec said customers of its corporate anti-virus would be able to add Sygate's access-control agent. The deal closed on 11 October; on 30 November Sygate's personal firewalls were discontinued. Two days after Symantec's announcement Secure Computing agreed to buy CyberGuard, maker of firewall and content-security software, for about $295 million, and on 22 August EarthLink, the Atlanta internet provider, agreed to buy the assets of Aluria Software of Orlando, best known for its Spyware Eliminator. In September 2007 Sygate's enterprise software was merged with Symantec's own into Symantec Endpoint Protection.
⏳ Time capsule — August 2005
- On 3 August researchers at Seoul National University led by Hwang Woo-suk announced Snuppy, an Afghan hound and the first cloned dog, created from an ear cell of a three-year-old adult and born on 24 April after 1,095 embryos had been transferred into 123 surrogate mothers. Hwang's stem-cell work was later found to involve fabrication; the university's own investigation confirmed that Snuppy was a genuine clone.
- On 3 August adidas-Salomon agreed to buy Reebok for $59 a share in cash, a premium of 34 per cent on the previous day's close, in a deal valued at about €3.1 billion, or $3.8 billion.
- On 5 August Baidu, China's leading search engine, began trading on Nasdaq at $27 a share and closed its first day at $122.54, up 354 per cent, the biggest one-day gain for a new listing since the last days of the dot-com boom.
- On 21 August NASA's Spirit rover reached the summit of Husband Hill on Mars, about 107 metres above the surrounding plains, and stayed nearly two months before starting down on 25 September.
Patch, Exploit, Worm
The week August 2005 compressed — a patch on Tuesday, public exploit code by Thursday, a worm by the weekend — would be run again. In October 2008 Microsoft broke its monthly routine to fix a flaw in the Server service, and Conficker was counted in millions of machines by January 2009; in March 2017 it patched the file-sharing flaw behind a National Security Agency exploit leaked the next month, and eight weeks after the patch WannaCry went through hospitals and railways in May 2017. Both times the patch had come first. Windows 2000, already out of mainstream support when Zotob arrived, received its last security fixes on 13 July 2010.
Titan Rain's attribution stayed a matter of belief. Published attribution came later and concerned later intrusions: a private firm's report placing a People's Liberation Army unit in a Shanghai building in February 2013, and an indictment naming five of its officers in May 2014, which China called fabricated. In India the word hacking stayed out of Section 66, as the expert committee had proposed, and its Section 79 carried India's later arguments over platform liability: rules in April 2011 gave a website thirty-six hours to act on a complaint, and in March 2015 the Supreme Court read the clause down so that only a court order or a government notice, not a complaint, could cost an intermediary its protection.