On Saturday 1 July 2006 H D Moore, who had created the Metasploit Framework, began posting a web-browser flaw a day to a blog called Browser Fun, under the title Month of Browser Bugs. "We will publish a new browser hack, every day, for the entire month of July," he announced; the blog would "serve as a dumping ground for browser-based security research and vulnerability disclosure." Each entry came with proof-of-concept code, picked "to demonstrate a concept without disclosing a direct path to remote code execution." By Wednesday 5 July there were five: three in Internet Explorer, one in Firefox, one in Apple's Safari. A posting on Sunday 2 July gave the reason: "This information is being published to create awareness about the types of bugs that plague modern browsers".
The same posting named a second purpose, "to demonstrate the techniques I used to discover them." They were fuzzers, programs that feed software malformed input until it breaks. Moore had worked on three for browsers, Hamachi, CSSDIE and DOM-Hanoi. The CSS one, written with Matt Murphy, Aviv Raff and Thierry Zoller, fed "common bad values" into style properties; its page reported Firefox 1.5.0.1 passing every test and Internet Explorer 6 crashing "in at least one place". "We could probably release one a day for the next two and a half years without running out of bugs," Moore said. A fourth, AxMan, aimed at ActiveX controls, found nearly every ActiveX bug of the month, Dark Reading reported; he released it free after July, holding back his blacklist "to buy Microsoft some time".
Two of the Internet Explorer bugs, Moore said, had been reported to Microsoft on 6 March and were still unpatched almost four months later; Stephen Toulouse of its security response centre said the company had seen the bugs in advance, that some could crash the browser and others had been fixed in earlier updates. Its emailed statement said that most of the Internet Explorer issues would simply make the browser close unexpectedly. Microsoft typically treated browser crashes as stability problems for service packs rather than monthly security fixes — a habit that had misfired in November 2005, when a JavaScript flaw filed as a crash acquired exploit code. Roger Thompson of Exploit Prevention Labs objected: "Just about any application-crash vulnerability can be turned into arbitrary code execution."
Moore kept to the clock. A commentator writing as "security curmudgeon", who had pre-assigned OSVDB identifiers to every entry, counted him on time on thirty of the thirty-one days; on the last he fell two hours behind, writing up a flaw in Safari. The tally was twenty-five in Internet Explorer, two each in Safari and Mozilla's browsers, one each in Opera and Konqueror, a count both the curmudgeon and Bruce Schneier warned against reading as a verdict on which browser was safer. Moore had not said how many of his crashes could be taken further. Entry eighteen was an integer overflow in the WebViewFolderIcon control, known as setSlice; when Microsoft patched it on 10 October in MS06-057, rated Critical, the bulletin recorded that it was being exploited.
The Home Secretary's Signature
On Tuesday 4 July 2006 the Home Secretary, John Reid, signed the order for Gary McKinnon's extradition to the United States; it was announced two days later. District Judge Nicholas Evans had recommended extradition on 10 May, eleven months after police arrested McKinnon at his north London home, and Reid's office said he was unconvinced by the defence's arguments. A federal grand jury in Alexandria, Virginia had indicted him on seven counts on 12 November 2002; the Justice Department's release that day counted ninety-two computers of the Army, Navy, Air Force, Defense Department and NASA, and six of private businesses, entered between March 2001 and March 2002. In London, American lawyers spoke of ninety-seven computers and at least $700,000 of damage. McKinnon denied causing damage and said he had been looking for evidence that the United States was concealing UFOs. "I am very worried and feeling very let down by my own government," he told the BBC; he had fourteen days to appeal. The appeals ran to the High Court in July 2009 and Theresa May's decision in October 2012; he was never tried.
A Speech in an Attachment
On 11 July 2006 the Associated Press reported that the State Department was recovering from break-ins at its headquarters and at offices dealing with China and North Korea, recognised in mid-June, and that internet access had been curtailed during the clean-up; officials speaking anonymously believed passwords had been stolen and back doors left in unclassified machines. The department said only unclassified systems were involved, and one spokesman called the case "a textbook example of our ability to detect and defeat threats before they do any damage." How it began emerged nine months later, before a House subcommittee on 19 April 2007. "In late May 2006," Donald Reid of Diplomatic Security testified, "a socially engineered e-mail was sent to an employee in the East Asia Pacific region" — with a Word attachment of a congressional speech, exploit code for an unpatched flaw hidden inside; analysis turned up a second in the operating system. When staff saw data leaving, the region was cut off from the internet, its infected machines sanitised and rebuilt. Homeland Security's written testimony linked the operating-system flaw to MS06-040, August's bulletin. No intruder was named.
Seventeen Addresses
On 11 July 2006 seven bombs on Mumbai's suburban trains killed 209 people. Two days later the Department of Telecommunications wrote to licensed internet providers with a list of addresses to block — seventeen sites and blogs by most counts — and no reasons. The chain ran under a procedure notified in February 2003: CERT-In, the computer emergency team, instructed; the department, as licensor, ordered; the providers blocked. Several entries were single blogs on shared hosts, and a provider able to block only a domain or network address could not separate one blog from the next. Spectranet said it could comply only by blocking whole domains — "We have a hell of a task on our hands," said B. C. Jain, its chief operating officer — and at provider after provider Blogspot, TypePad and GeoCities stopped loading, one reader meeting only "Site BLOCKED!!!!".
Bloggers organised through a Google group and a wiki, logged which provider blocked what, and filed Right to Information requests for the list. CERT-In's director, Gulshan Rai, said the order was not a specific response to the bombings and that "Blogspot.com should not be blocked"; on 19 July the deputy consul general in New York said two pages had been meant, and blamed "a technological error". On Thursday 20 July the department told providers to give "unhindered Internet access" to all but the named sites and to explain any wider blocking; access returned provider by provider. It had happened before: in 2003 the procedure's first block, aimed at one Yahoo group, took all of groups.yahoo.com. The blocking rules of 2009 settled the question of the list: "Strict confidentiality shall be maintained regarding all the requests and complaints received and actions taken thereof." CERT-In is better known now for another duty.
Deep networks return as AI turns fifty
On 28 July 2006 Science published a paper by Geoffrey Hinton and Ruslan Salakhutdinov on autoencoders, networks that squeeze data into a short code and rebuild it. Deep ones had been all but untrainable from random weights; the pair pretrained them a layer at a time as stacked restricted Boltzmann machines, then fine-tuned the whole by backpropagation. On handwritten digits, face images and 804,414 newswire stories the codes beat principal components analysis and methods built on it. In the same issue Garrison Cottrell noted that some had considered neural networks dead, and suggested the work showed that verdict to be premature. Neural Computation's July issue carried the groundwork, Hinton's fast, greedy algorithm for deep belief nets with Simon Osindero and Yee-Whye Teh. AI@50, at Dartmouth from 13 to 15 July with five of the 1956 workshop's participants, and AAAI-06, in Boston from 16 to 20 July, marked the field's half-century. The two papers helped start the revival that became deep learning; Hinton shared the 2024 Nobel Prize in Physics.
Microsoft buys Winternals and Sysinternals
On 18 July 2006 Microsoft announced it had acquired Winternals Software, a privately held company in Austin, Texas, that sold recovery and data-protection tools for Windows, and with it Sysinternals, the freeware site whose Filemon, Regmon and Process Explorer were fixtures of Windows troubleshooting. Terms were not disclosed. Mark Russinovich and Bryce Cogswell had founded both in 1996, the site as NTInternals, and in October 2005 Russinovich had used its blog to expose the copy-protection rootkit a Sony BMG music CD had installed on his computer. He joined Microsoft as a technical fellow, Cogswell as a software architect. "I've had my eye on Mark for some time," said Jim Allchin, co-president of the Platforms and Services Division. Russinovich wrote that Winternals technology would find its way into Microsoft products or carry on under Microsoft's name, and that the tools would remain free to download. They still are, joined in 2014 by Sysmon, which logs system activity for security analysis; Russinovich became chief technology officer of Microsoft Azure.
⏳ Time capsule — July 2006
- On 4 July Discovery lifted off from pad 39B at the Kennedy Space Center on STS-121, NASA's second return-to-flight test mission, after two weather delays; it landed back at Kennedy on 17 July, leaving Thomas Reiter aboard the International Space Station as a member of the Expedition 13 crew.
- On 6 July the Nathu La pass between Sikkim and Tibet, sealed after the 1962 war and shut for more than four decades, reopened for border trade. The ceremony went ahead in heavy rain and cold wind, a hundred traders from each side crossed to the other's trading town, and a ten-metre stone-walled passage had replaced the barbed wire.
- On 9 July Italy won the World Cup at the Olympiastadion in Berlin, beating France 5–3 on penalties after a 1–1 draw. Zinedine Zidane, who had scored France's seventh-minute penalty, was sent off in extra time for headbutting Marco Materazzi, Italy's scorer.
- On 15 July Twitter, built at Odeo and used until then by the company's own staff, was introduced to the public; it had been created that March under the name twttr.
What a Crash Is Worth
Moore's month is remembered as the original of a genre and for putting fuzzing in front of the public. The calendar was copied within months — the Month of Kernel Bugs in November, the Month of Apple Bugs in January 2007, the Month of PHP Bugs that March — and the quarrel with Microsoft over whether a crash counts as a security bug was settled by setSlice before the year was out. The browser makers' lasting answer was to fuzz their own code: Google announced ClusterFuzz for Chromium in April 2012 and OSS-Fuzz for open-source projects in December 2016, and by 2019 ClusterFuzz was fuzzing Chrome continuously on more than twenty-five thousand cores. In February 2017 a fuzzing run's strange output led a Google researcher to Cloudflare's leak.
The month's other stories ended as such stories usually do. McKinnon's signed order bought six more years of appeals and, after October 2012, no trial anywhere. The State Department's attachment — a congressional speech, opened by one employee — became a familiar first move in espionage, down to the spreadsheet in a message headed "2011 Recruitment plan" that opened RSA in March 2011. Moore kept publishing; in July 2008 he and I)ruid released a Metasploit module for Dan Kaminsky's DNS flaw two days after the details leaked. Behind this edition the archive runs back through June 2006 to January 2006.