The alert went out from Websense Security Labs in San Diego on Monday 23 May 2005. A website had used a flaw in Windows' HTML Help, reachable through Internet Explorer and patched by Microsoft in July 2004 as MS04-023, to plant a program on a visitor's computer without the user doing anything. That program went through the disk for some fifteen kinds of file — documents, web pages, photographs, databases, spreadsheets, Zip and RAR archives — encrypted what it found, deleted the originals and left a text file named ATTENTION!!! in each folder it had touched. Then it deleted itself.
The note said that some files had been coded and gave an e-mail address for anyone who wanted to buy a decoder; the price, by the accounts of the time, was $200, payable into an account at e-gold, an online currency. Dan Hubbard of Websense Security Labs alerted the SANS Internet Storm Center the same day, and the Storm Center told Windows users to check that the July 2004 patch was installed. Symantec named the program Trojan.Pgpcoder and Trend Micro TROJ_PGPCODER.A. It had no routine for spreading itself — it did not mail itself to its victims' contacts or look for other machines — and it was rarely seen, which kept its victims few.
The cryptography was the weak point. Despite its name, the program did not use PGP but a home-made scheme that was easy to break. Joe Stewart, a senior security researcher at LURHQ, wrote a decryptor so that victims need not pay, and Kaspersky Lab added a decryption routine to its own database. Stewart's warning lasted longer. If the author kept being paid and moved to stronger encryption, he said, defenders could only hope to get the key from the author himself, and victims would have to pay or wait for the police to recover it.
None of it was quite new. The AIDS trojan of 1989 had come on floppy disks by post and asked for $189 to be sent to a post-office box in Panama, and in 1996 Adam Young and Moti Yung had shown how public-key cryptography could make such extortion secure. Kaspersky Lab, which calls the family Gpcode, had first seen a version in December 2004. The family learned Stewart's lesson in public: Kaspersky broke a 660-bit RSA key in June 2006, but not the 1024-bit key of Gpcode.ak in June 2008. That September Techworld reported that police had found the program's probable author.
A Proposal on a Disc
On Sunday 29 May 2005 a Tel Aviv court lifted a gag order, and Israeli police described an inquiry begun in November 2004, when the author Amnon Jackont complained that part of a book he was still writing had appeared online. On his computer they found a trojan sending documents and pictures to FTP servers in Israel and abroad, and traced it to Michael Haephrati, a former son-in-law of Jackont's wife, arrested in London with his own wife, Ruth. Copies tailored to each target, so that anti-virus software missed them, had been sold, police said, to three licensed private investigation agencies, which sent them to their clients' rivals by e-mail or on discs disguised as business proposals. Eighteen people were detained, among them managers at clients including the satellite broadcaster Yes, the mobile operators Pelephone and Cellcom and the car importer Mayer; the companies denied wrongdoing. Extradited from Britain in January 2006, the couple admitted most of the charges under a plea agreement; Ruth was jailed for four years and Michael, as her accomplice, for two. In April 2008 four members of one of the agencies, Modi'in Ezrahi, were sentenced, three of them to prison.
Mail on a Timetable
Sober.P, first seen on 2 May 2005, came as mail announcing that the recipient had won tickets to the 2006 World Cup. It mailed itself on and, by Sophos's count, stormed to the top of the virus charts in early May before falling quiet; F-Secure lowered its alert on 13 May. On Saturday 14 May the infected machines began downloading Sober.Q, which did not spread at all. It gathered addresses from files on the disk and, between 15 and 22 May, checking the date against internet time servers, mailed in German to addresses ending in .de, .at, .ch and .li and in English elsewhere; Symantec estimated the messages in the tens of millions. They carried links to German nationalist articles and websites. By Friday 20 May warnings were going out that the infected machines would do something new on Monday 23 May — the day Sober.Q was written to stop mailing and try to fetch and run a new file from personal home-page hosts in Germany and Austria, in a folder whose name it computed from the date. Sober was back in November.
A Separate Service
On 3 May 2005 the Telecom Disputes Settlement and Appellate Tribunal ruled on a petition by the Internet Service Providers Association of India, joined by members such as Spectranet and GTL, against the Department of Telecommunications. Its subject was the virtual private network, a business's private network run over a provider's infrastructure. The ISPs said they had sold VPNs for years with the knowledge of the department, the regulator TRAI and BSNL. On 16 December 2004 the department had issued guidelines bringing VPNs into the ISP licence for an entry fee of Rs 10 crore, 2 crore or 1 crore by category, plus 8 per cent of adjusted gross revenue a year; on 17 January 2005 it told ISPs to stop providing them within 30 days.
The tribunal agreed that an end-to-end managed VPN on leased lines was not part of an ISP licence — “it becomes a separate service” — but ruled that TRAI's recommendations, mandatory for a new service, had to come first. Until the government had them, and decided within four months, the guidelines stood as “ad-hoc”: ISPs could keep selling VPNs by paying, subject to adjustment. Security appeared only where the order explained the product: “The subscribers are given passwords and through firewalls and additional security measures are made a secure network.” In 2005 the question was who could sell the tunnel; by 2022 it was who was inside it. CERT-In's directions of 28 April required VPN providers to keep subscribers' validated names, addresses and allotted IP addresses for five years, as our India desk sets out, and ExpressVPN said it would move its Indian servers to Singapore and the UK (June 2022).
ScanSoft to buy Nuance; a robot copies itself
On Monday 9 May 2005 ScanSoft, of Peabody, Massachusetts, agreed to merge with Nuance Communications, of Menlo Park, California, giving 0.77 of a ScanSoft share and $2.20 in cash for each Nuance share: about $221 million, or $122 million net of Nuance's cash. ScanSoft had taken over the Dragon dictation software after Lernout & Hauspie's collapse; Nuance, spun out of SRI International in 1994, sold speech recognition that let callers talk to automated telephone services. Between them, they said, their software handled more than 20 million calls a day to contact centres and directory assistance. The combined company was the one Microsoft agreed to buy for $19.7 billion including debt in April 2021. In Nature's issue of 12 May, Hod Lipson's group at Cornell described a robot of four ten-centimetre cubes, each split along a diagonal so that its halves could swivel, which built a copy of itself within a few minutes from cubes fed to it. Cornell noted that it did nothing else useful; of runaway machines, Lipson said: “I don't think we're anywhere near that.”
Trend Micro buys InterMute; House passes spyware bills
On Tuesday 10 May 2005 Trend Micro said its American subsidiary would buy InterMute, an anti-spyware developer in Braintree, Massachusetts, for about $15 million, subject to due diligence. InterMute, founded in 1999, had 35 employees and sold SpySubtract to homes and companies; Trend, which had launched business anti-spyware suites the month before, planned to sell InterMute's stand-alone products under its own brand. Eva Chen, Trend's chief executive, called InterMute's products complementary to Trend's own and promised combined products quickly; by the year's end SpySubtract had been absorbed into Trend's anti-spyware line. On Monday 23 May the House of Representatives passed two spyware bills for the second time in seven months: Mary Bono's SPY Act, 393 to 4, requiring consent before software that collected personal information was installed, with fines of up to $3 million, and Bob Goodlatte's I-SPY Prevention Act, 395 to 1, with up to five years in prison for using spyware to commit another federal crime. Microsoft asked the Senate to shield anti-spyware vendors from lawsuits by spyware distributors. The Senate never acted on either; in May 2007 the House passed I-SPY again.
⏳ Time capsule — May 2005
- On 14 May the pilot Didier Delsalle touched a Eurocopter AS350 B3 down on the 8,848-metre summit of Mount Everest, the first helicopter landing there, and repeated it the next day to show that the first had not been luck.
- On 19 May Star Wars: Episode III – Revenge of the Sith, shown out of competition at Cannes three days earlier, opened in the United States and most other countries, completing George Lucas's trilogy of prequels.
- On 25 May, at the Atatürk Olympic Stadium in Istanbul, Liverpool trailed AC Milan 3–0 at half-time in the Champions League final, scored three times in six minutes through Steven Gerrard, Vladimír Šmicer and Xabi Alonso, and won 3–2 on penalties after Jerzy Dudek saved from Andrea Pirlo and Andriy Shevchenko.
- On 31 May Vanity Fair published an article by John D. O'Connor, a lawyer acting for W. Mark Felt, the FBI's former associate director, now 91, in which Felt said: “I'm the guy they used to call Deep Throat.” Bob Woodward and Carl Bernstein confirmed that he had been their Watergate source.
Pay or Wait
Stewart's choice — pay, or wait for someone to recover the key — became a victim's ordinary condition once the keys stopped breaking, and the money moved with it. The company behind e-gold, the 2005 note's currency, was indicted in 2007 and reached a plea agreement in 2008; Liberty Reserve, which later Gpcode versions accepted, was shut down in May 2013. That autumn CryptoLocker gave extortion a countdown and a desk for late payers (November 2013); in May 2017 WannaCry carried a demand for bitcoin through a worm; and by December 2019 Maze was publishing the files of victims who would not pay, so that paying bought silence too. Young and Yung had written in 1996 of extortion that only the attacker's key could undo; the note of May 2005 put a price on it.
The other stories ended in court and in habit. The market the Haephratis supplied — clients who wanted other people's papers, investigators willing to break the law to get them — reappeared at Hewlett-Packard, and the trojan tailored to its target became a product sold to governments, from Hacking Team to NSO Group's Pegasus. Conficker would compute its addresses from the date as Sober.Q had, at 250 names a day (February 2009). And Time Warner, which disclosed on 2 May that 40 unencrypted backup tapes with names and Social Security numbers of some 600,000 employees, former employees, dependents and beneficiaries had gone missing from an Iron Mountain van on 22 March, showed how much an unencrypted tape could carry, a year before Washington asked its agencies to encrypt their laptops (May 2006).