Mark Russinovich found it on one of his own computers. Testing a new version of RootkitRevealer, the detector he had written with Bryce Cogswell, in late October 2005, he saw cloaked registry keys, cloaked files and a hidden directory he could not account for. He traced them to a licence he had accepted from the autorun program of a Sony BMG CD he had bought, Van Zant's Get Right With the Man. The software, XCP, came from First 4 Internet of Britain. Its driver, aries.sys, intercepted Windows system calls to hide every file, registry key and process whose name began with “$sys$”; the licence did not mention it, and deleting the files by hand could disable the CD drive. He blogged his findings on Monday 31 October, and the post drew a flood of comments.
Sony BMG's first answer, posted on Wednesday 2 November, was a First 4 Internet service pack that, the label said, removed the cloaking component; XCP stayed, and the patch, Russinovich found, unloaded the driver while Windows ran, which could crash it. On Friday 4 November Thomas Hesse, president of Sony BMG's global digital business, told National Public Radio: “Most people, I think, don't even know what a rootkit is, so why should they care about it?” On 8 November Computer Associates classified XCP as spyware. On 10 November Trend Micro warned of a Breplibot trojan, mailed as a business magazine's request to verify a “picture” for its December issue, that installed itself as $sys$drv.exe — invisible on any machine carrying XCP; only a rootkit scanner such as RootkitRevealer, Trend Micro's analyst said, could unmask it.
Sony BMG suspended the manufacture of XCP discs on Friday 11 November, and said on Monday the 14th that it would pull them from shops and swap customers' copies; Reuters reported 49 titles, about 4.7 million discs produced and about 2.1 million sold — figures Sony BMG had given The New York Times. The way out was worse than the cloak. Asking for the uninstaller brought an emailed link to a page that installed an ActiveX control, CodeSupport, and on 15 November J. Alex Halderman and Edward Felten of Princeton showed that “any web page” could then make it “download and install code from any URL” — “about as serious as a security flaw can get.” Two days later Halderman found the same class of hole in the uninstaller for MediaMax, SunnComm's copy protection on other Sony BMG discs; on 28 November he showed that MediaMax installed files even when a listener declined its licence.
Nobody outside the company knew how far it had spread. Dan Kaminsky asked name servers around the world whether their caches held the addresses the software contacted; about 568,000 did, which pointed to at least one infected machine on each of those networks — a floor, not a count, since only the software's makers could know the true figure. On Monday 21 November Texas sued Sony BMG, the first state to do so and the first case under its new anti-spyware law, and the Electronic Frontier Foundation filed a class action in Los Angeles. The states settled in December 2006, and on 30 January 2007 a Federal Trade Commission settlement required Sony BMG to repay up to $150 for damage done in removing the software. “Consumers' computers belong to them,” said the FTC's chairman, Deborah Platt Majoras.
Your IP Was Logged
F-Secure dated the worm to 15 November 2005: a new Sober, called Sober.X by some and Sober.Y in F-Secure's naming, sent from addresses such as Department@fbi.gov and Department@cia.gov under subjects like “Your IP was logged”. It said the recipient's IP address had been recorded on more than 30 illegal websites and asked for answers to questions in an attached zip file; a German version, in the name of the Federal Criminal Police Office, came headed “Sie besitzen Raubkopien” — you possess pirated copies. Opened, it showed a fake error message, copied itself into a folder called WinSecurity under system-file names, dropped files meant to deactivate earlier Sobers, and mailed itself on. It spread widely from about 21–22 November; MessageLabs, which stopped its first copy at 19:00 GMT on the 21st, had stopped nearly three million by the middle of the next day. The FBI and the CIA said on their websites that they had sent no such messages and urged recipients not to open them. Its agents had arrested a botnet operator, Jeanson James Ancheta, on 3 November; January 2006 tells his case.
Ahead of the Wire
On Tuesday 1 November 2005 the Securities and Exchange Commission went to federal court in New York with an emergency action against Lohmus Haavel & Viisemann, an Estonian investment bank, and two of its employees. The firm had become a client of Business Wire in June 2004. Through that access, the commission alleged, a “spider” program had reached other clients' press releases before publication, and since early 2005 the defendants had traded ahead of more than 360 of them, from more than 200 American public companies, for at least $7.8 million. The court froze their assets and ordered money taken out of the United States brought back. The firm, the commission said, had signed up with Business Wire solely to reach the wire service's secure client website. The defendants settled without admitting or denying the allegations: a partner in August 2006, giving up $551,958, and on 30 May 2007 the firm, with a $650,000 penalty, and the other employee, ordered to disgorge $13 million and pay $1.35 million. The firm is now LHV, a banking group listed in Tallinn.
A Shared Resource
The second phase of the World Summit on the Information Society opened in Tunis on Wednesday 16 November 2005, and India's minister of communications and information technology, Dayanidhi Maran, spoke on its first day. Most of his statement concerned the gap between the people computing had served and those who needed it most — “Unless the computer reaches virtually every home, it cannot become an effective weapon against underdevelopment” — but one sentence went to the summit's central quarrel, over the United States' authority over the root zone, the master list of the internet's top-level domains: “If the Internet is a shared resource, so must be its oversight and management.” An agreement reached as the summit began had left that authority where it was. Maran welcomed what the meeting did offer, first steps towards a multi-stakeholder, democratic and transparent system, as a “preliminary and modest step”.
The Tunis Agenda, adopted on 18 November, found that “the existing arrangements for Internet governance have worked effectively”, promised “enhanced cooperation” so that governments could play their public-policy roles “on an equal footing”, and asked the UN Secretary-General to convene an Internet Governance Forum with “no oversight function”. Its security clauses were short: “We underline the importance of the prosecution of cybercrime,” and a resolution to deal with spam. India hosted the forum's third meeting, in Hyderabad, from 3 to 6 December 2008; that month the Lok Sabha passed amendments to the IT Act without debate. The arrangement Maran questioned changed in October 2016, when the US government's contract with ICANN for the IANA functions was allowed to expire, and the General Assembly closed its twenty-year review of the summit in December 2025.
Amazon opens Mechanical Turk; iRobot goes public
On 2 November 2005 Amazon opened Mechanical Turk, a web service through which a program could hand people the simple tasks at which they still beat computers, such as identifying objects in photographs. Amazon billed it as “Artificial Artificial Intelligence”, and named it after the eighteenth-century chess automaton that concealed a human master. Between 2008 and 2010 some 49,000 of its workers, in 167 countries, sorted the pictures of ImageNet, the collection behind the deep-learning boom, and in August 2026 Amazon said it would close the service on 30 September. On 9 November iRobot, which had sold more than 1.5 million Roomba vacuum cleaners in three years and more than 300 PackBot military robots, most of them deployed in Afghanistan and Iraq, began trading on Nasdaq at $24 a share. In Bilbao from 20 to 23 November three former FIDE world champions, Ruslan Ponomariov, Rustam Kasimdzhanov and Alexander Khalifman, lost 8–4 to the programs Hydra, Deep Junior and Fritz 9; Ponomariov's win over Fritz was the humans' only one.
Vendors chase XCP; OneCare opens to testers
In Wired on 17 November 2005 Bruce Schneier found the anti-virus vendors slow to act against Sony BMG's rootkit: McAfee did not add detection until 9 November, and Symantec, which said the cloak had been designed to hide a legitimate application, posted a tool to remove it on the 11th. On the 12th Microsoft's anti-malware team promised a signature for XCP's rootkit component to the millions using its Windows AntiSpyware beta, and to the Malicious Software Removal Tool in December. Schneier praised only F-Secure, which had criticised Sony first and most loudly, and asked: “Who are the security companies really working for?” Late on Tuesday 29 November Microsoft opened its own security service, Windows OneCare Live — anti-virus scanning, a firewall, tune-ups and backup, to be sold by subscription — to public beta testing, inviting anyone with the American edition of Windows XP to try it free after uninstalling any Norton or McAfee software. It reached the shops in May 2006; since Windows 8, Microsoft's anti-virus has come with Windows itself, as Defender.
⏳ Time capsule — November 2005
- On 19 November Japan's Hayabusa probe touched down on the asteroid Itokawa without firing its sampling projectile, and on the 25th it touched down again; later analysis suggested the projectile had not fired that time either. Its return capsule landed near Woomera, in South Australia, on 13 June 2010, and that November JAXA confirmed that particles inside had come from Itokawa.
- On 22 November the Bundestag elected Angela Merkel Chancellor of Germany by 397 votes to 202, at the head of a grand coalition of the CDU, the CSU and the SPD. She was the first woman to hold the office, and held it until 8 December 2021.
- On 26 November Vijaypat Singhania rose from a racecourse in Mumbai in a pressurised capsule beneath a Cameron Z-1600 balloon and reached 21,027 metres, a world altitude record for a hot-air balloon, verified by the FAI; he came down about five hours later near Panchale, in Nashik district.
- On 27 November surgeons at Amiens-Picardie University Hospital — Bernard Devauchelle, Benoît Lengelé and Jean-Michel Dubernard — performed the first partial face transplant, grafting a triangle of tissue from a deceased donor's nose and mouth onto a woman injured earlier that year. It was made public on 30 November.
Where Windows Looked Least
What Russinovich found was an old technique in new hands. Hooking the system-call table to hide files had been demonstrated years before by NTRootkit, sample code later published on rootkit.com; what was new was a mainstream company using it to hide its own software from the machine's owner. Installing secret software that created security risks, the FTC's chairman would say, was “intrusive and unlawful”. Sony BMG eventually stopped putting copy protection on the CDs it sold in the United States. The technique moved on to where Windows looked least. The 64-bit editions already crashed any machine whose system-call table had been altered, and the rootkits in this archive's later editions went into the boot record, with Mebroot in January 2008; into drivers bearing a genuine company's signature, in July 2010; and into firmware, with LoJax in September 2018.
The month's other threads ran long. Kaminsky, who had measured Sony's reach by peering into name servers' caches, showed in July 2008 how an attacker could fill those caches with lies, and Halderman and Felten turned the same kind of public analysis on a Diebold voting machine ten months on. Sober's letter from the FBI — an authority accusing the reader of an offence, with a way to answer attached — proved a durable pretext; in India it now arrives as a video call, the opening move of the frauds Fraud Watch follows. And the trade the SEC interrupted in Estonia returned at scale: in August 2015 the commission alleged that two men had spent five years inside newswire services.