On Wednesday 27 July 2005 the audience that had come to the Black Hat Briefings in Las Vegas to hear Michael Lynn of Internet Security Systems was told that the Cisco material in his advertised talk, “The Holy Grail: Cisco IOS Shellcode and Remote Execution”, would not be presented; he would talk about voice over IP instead. Lynn then said he had resigned from ISS, and gave the talk anyway. A heap overflow in Cisco's IOS often did no more than make a router reload when its Check Heaps process noticed the damage; Lynn showed how to make one run an attacker's code. “What I just did means I'm about to get sued by Cisco and ISS,” he told the room.
The pages describing the talk — twenty, by one account — had been torn from the printed conference proceedings, and the CDs carrying his slides seized and replaced. Jennifer Granick, the Stanford lawyer who became his counsel, wrote that she had heard Cisco sent temporary workers to do the cutting. ISS had approved the talk and then forbidden it, and Lynn said he had quit because its executives insisted he strike key portions: “In large part I had to quit to give this presentation because ISS and Cisco would rather the world be at risk, I guess.” Cisco said the talk “was not a disclosure of a new vulnerability or a flaw with Cisco IOS software”, and that it believed the material “contained proprietary information” that had been obtained illegally.
That Wednesday evening Cisco and ISS sued him and Black Hat in federal court, claiming copyright in the slides and the decompiled code, misappropriation of trade secrets and breach of a non-disclosure agreement, and asked for a temporary restraining order. Overnight talks produced an agreed permanent injunction instead, entered at once on the Thursday afternoon, 28 July: Lynn and Black Hat would not distribute the presentation, its video or the decompiled code, Lynn would hand back the materials and code he held, and he would not present the work again at Black Hat or at DEF CON that weekend. Cisco and ISS agreed to drop the suit once he had complied.
That Thursday evening two FBI agents, from the Las Vegas office at the Atlanta office's request, asked about the talk at the conference; in August Granick wrote that there were no criminal charges and that she was confident there never would be. Cisco's advisory followed at 08:00 GMT on Friday 29 July: a crafted IPv6 packet from the local segment could make a router configured for IPv6 reload, or potentially run code — a flaw, it said, disclosed at Black Hat. Cisco had already released fixed software before the talk, without announcing the flaw. On 2 November, after “continued research related to the demonstration”, it disclosed a second heap overflow, in IOS's system timers, and added integrity checks to make such attacks harder. Router compromise would move from stage to practice, as September 2015 recounts.
Behind Closed Doors in Verden
In a courtroom in Verden, Lower Saxony, closed to the public because he had been under eighteen when he wrote the worm, the author of Sasser admitted on Tuesday 5 July 2005 that he had written and spread it. Sasser had spread from late April 2004 through a flaw in the Windows LSASS service that Microsoft had patched seventeen days before it appeared: Delta Air Lines cancelled transatlantic flights, Agence France-Presse lost its satellite communications for hours and Britain's coastguard its electronic mapping. The indictment put the damage at around €130,000; experts assumed it ran into the millions, since many companies had for a time been unable to work. On Friday 8 July the court found him guilty of computer sabotage and illegally altering data and gave him a youth sentence of twenty-one months, suspended, with three years' probation and thirty hours' community service in a hospital or a home for the elderly. Microsoft welcomed the verdict, saying the author had admitted responsibility for the damage and was being held accountable, and paid its $250,000 reward to two acquaintances from his school who had identified him.
Points for a Flaw
On Monday 25 July 2005, two days before Lynn spoke, TippingPoint, 3Com's intrusion-prevention business in Austin, launched its Zero Day Initiative, offering to pay researchers for vulnerabilities. A researcher would submit a flaw privately and receive an offer for it; what was paid counted as points, one a dollar, and the points earned status tiers from bronze to platinum, with bonuses attached — the scheme the initiative still runs. TippingPoint would tell the software's maker, protect its own customers in the meantime with filters that did not give the flaw away, and in some cases share details with other security vendors. The programme was led at first by David Endler and Pedram Amini. The first advisory, on 12 October, was a code-execution flaw in Veritas NetBackup reported by Kevin Finisterre; in 2007 the initiative's $10,000 bounty was the prize money at the contest that became Pwn2Own.
When a Phone Became a Computer
On 29 July 2005 Justice V.V.S. Rao of the Andhra Pradesh High Court ruled on petitions from employees of Tata Teleservices, which sold mobile service in the state as Tata Indicom, asking him to quash a criminal case against them. Reliance Infocomm had complained, and the state CID had registered the case in 2003. Reliance sold Samsung and LG handsets that, it said, were for its network alone — about Rs 10,500 of phone for Rs 3,350 down and Rs 600 a month over three years. The complaint alleged that its subscribers were lured away and their handsets' electronic serial numbers reprogrammed so the phones would work on Tata's network.
The employees had argued that a phone was not a computer. The judge quashed the Penal Code charges of breach of trust, cheating and conspiracy, but let stand those of tampering with computer source code under Section 65 of the IT Act and of copyright infringement, rejecting the argument: a cell phone, he held, was a computer, and its serial number and network codes were, prima facie, source code. How the case ended is not in any record this edition could find. In December 2008 Parliament wrote “cell phones” into the Act by name and made cheating by personation through such a device an offence.
AAAI's game-playing contest; robot football in Osaka
The American Association for Artificial Intelligence held its twentieth national conference, AAAI-05, in Pittsburgh from 9 to 13 July 2005, and celebrated its twenty-fifth anniversary there. It staged the first General Game Playing Competition, devised at Stanford: each program was handed only a formal description of a game and had to play it without human help, unlike Deep Blue, built for chess alone. There were nine entrants, and Cluneplayer, by Jim Clune of UCLA, took the $10,000 prize. As the conference closed, RoboCup 2005 opened in Osaka, running until 19 July with hundreds of teams from more than thirty countries. Its humanoid league moved from one-on-one play to two-on-two matches, and a local entry, Team Osaka, took the Louis Vuitton Humanoid Cup; in the four-legged league, played with Sony's Aibo robot dogs, the GermanTeam beat Australia's NUbots in the final. Minoru Asada, the RoboCup Federation's acting president, said it was important “to stimulate industries with RoboCup”.
Symantec absorbs Veritas; Microsoft to buy FrontBridge
Symantec completed its acquisition of Veritas Software on Saturday 2 July 2005, and the maker of backup and storage-management software became a wholly owned subsidiary of the security company. On 24 June the shareholders of both had approved the all-stock deal, valued at $13.5 billion when it was announced in December, despite a few grumbles from large holders and analysts and doubts whether slower-growing Veritas would weigh down a revitalised Symantec, whose shares had lost more than 30 per cent since the announcement. On 20 July Microsoft said it would buy FrontBridge Technologies of Los Angeles, which filtered spam and viruses out of businesses' mail and archived it for them, on terms it did not disclose; Dave Thompson, corporate vice-president of its Exchange Server Group, called the services “a perfect complement to Exchange”. FrontBridge's filtering became Exchange Hosted Services in 2006 and, after a spell under the Forefront name, Exchange Online Protection in 2013; Symantec sold Veritas to investors led by the Carlyle Group in January 2016.
⏳ Time capsule — July 2005
- On 2 July ten Live 8 concerts were held on a single day, from Hyde Park and Versailles to Philadelphia, Chiba, Johannesburg and Moscow, organised by Bob Geldof and Midge Ure and timed to precede the G8 summit at Gleneagles, in support of the Make Poverty History campaign; an eleventh followed in Edinburgh on 6 July.
- On 4 July the 372-kilogram, copper-cored impactor released by NASA's Deep Impact struck the nucleus of comet Tempel 1 at about ten kilometres a second — 05:52 UTC, as the signal reached Earth — leaving a crater later put at about 150 metres across.
- On 6 July, at the International Olympic Committee's 117th session in Singapore, London was chosen to hold the 2012 Summer Olympics, beating Paris by 54 votes to 50 in the final round after Moscow, New York and Madrid had gone out.
- On 21 July the People's Bank of China ended the renminbi's peg to the US dollar, revaluing it at once to 8.11 to the dollar and letting it trade within a narrow band against a basket of currencies; Malaysia dropped the ringgit's peg to the dollar the same day.
Like Any Computer
The talk's point was that a router is a computer like any other, and can be taken over like one. In 2005 it was a provocation; in 2026 it is a description. Cisco conceded the point in its own way, with November's integrity checks, and the following summer's Black Hat had its own quarrel with a vendor, over a hijacked MacBook. The routers themselves became targets in earnest: modified copies of IOS turned up on routers in four countries in September 2015, put there with valid credentials or physical access rather than through any flaw, and in October 2023 implants written onto Cisco's IOS XE devices through a flaw in their web interface were counted in the tens of thousands.
The month's other stories ended by becoming routine. Buying flaws, which TippingPoint dressed in points and status, became a market: the Zero Day Initiative is still paying researchers in 2026, and the contest its bounty first backed, in April 2007, is still held. The Sasser case's lesson, a worm built on a hole already patched, was taught again within weeks, as August recounts. And the ruling that a cell phone is a computer, contested in Hyderabad in 2005, is so plainly true twenty-one years on that the argument against it is the only part that now seems strange.