Windows Genuine Advantage Notifications was the half of Microsoft's anti-piracy programme that nagged: validation decided whether a copy of Windows XP was genuine, and Notifications told the owner of one that was not. It was still a pilot, and since late April it had been arriving through Automatic Updates. Lauren Weinstein, a co-founder of People for Internet Responsibility, ran licensed copies that had passed validation, and after a recent update he watched them reach out to Microsoft at every start, even with Automatic Updates turned off. On Monday 5 June 2006 he wrote that the tool would "attempt to contact Microsoft over the Internet every time that you boot", and that the update "may itself be considered to be spyware under commonly accepted definitions."
Microsoft answered him the next day and confirmed it publicly on Wednesday 7 June. Machines left running called once a day too. Nothing was sent from the PC, the company said, though its servers still saw the machine's internet address and the time. The purpose, Weinstein was told, was "an emergency 'escape' mechanism to allow MS to disable the validation tool" if the pilot misfired: each call checked a setting on Microsoft's server that said whether the program should run. The licence listed what validation sent — product key, PC maker, Windows version, BIOS details, locale and language — but did not make the daily call clear.
Microsoft promised a call every two weeks, then none, and moved faster than it had said. A copy judged pirated lost non-critical downloads, though not security updates. In the last week of June a Los Angeles man filed a class action in the federal court in Seattle, arguing that the tool broke Washington's and California's anti-spyware and consumer-protection laws. On Tuesday 27 June Microsoft released a version without the daily check. By its account to Weinstein, the new tool called once to report a successful installation and retried at log-on only on machines not yet validated, under a plainer licence that could be refused. A second suit followed within days, among other things accusing Microsoft of passing the tool off as a security update.
Microsoft fought the suits for more than three years. The plaintiffs combined their cases in the federal court in Seattle; in January 2010 the judge refused them a third attempt to make it a class action, and in February, by agreement, the case was dismissed without a trial, each side paying its own costs. The tool outlived the quarrel under another name: in Windows 7 its successor was Windows Activation Technologies. Weinstein had reduced the argument to "clarity and control", and those were what the June changes conceded — a licence that said what the tool did, and a way to say no.
The Spreadsheet in Repair Mode
On Friday 16 June 2006 Microsoft said it was investigating a report of a new, unpatched flaw in Excel; the attack that brought it to light had hit an unidentified business. Symantec was reported to have spotted it first, and Microsoft later credited Symantec's Costin Ionescu with the report. The spreadsheet carried what Symantec called Trojan.Mdropper.J. Opened, it dropped a downloader, Booli.A, into the system folder as svc.exe, which injected its code into Internet Explorer, possibly to slip past personal firewalls, and reached out for further files. Mike Reavey of Microsoft's Security Response Center stressed that nothing happened unless someone opened the document. The advisory of Monday 19 June traced the fault to Excel's repair mode and suggested blocking Excel attachments at the mail gateway; Excel 2000, which opened files without asking, was the most exposed. MS06-037 fixed it on 11 July by checking a record's length before copying it into a buffer, and acknowledged that it had been exploited — the second Office zero-day in as many months, after May's Word attacks.
Read Once, Sent On
The worm surfaced on Monday 12 June 2006. It came from av3@yahoo.com with the subject "New Graphic Site", and opening it was enough: a flaw in Yahoo Mail let script embedded in an HTML message run in the reader's browser instead of being blocked. The script imitated Yahoo's own contact-adding feature, read the address book, mailed itself to every address at yahoo.com and yahoogroups.com, and sent the harvest to a remote server that analysts said might be used for spam. Symantec, which named it JS.Yamanner@m, judged that it was spreading but had done no significant damage. Arrigo Triulzi, analysing it for SANS, found a second version about two hours in and judged the code "very much under development". Yahoo said it had closed the hole on its own servers, with nothing for users to install, and that the worm had reached only a small fraction of Yahoo Mail's users.
Access the Job Required
On 22 June 2006 HSBC Electronic Data Processing (India), the bank's back-office and customer-support arm in Bangalore, complained to the city's cyber crime police about one of its data operators, according to press accounts of the complaint. It alleged that he had taken British customers' personal, security and debit-card details and passed them to accomplices, who drew money through cash machines and telephone banking: about £233,000 from some twenty customers, by most reports. He had been suspended earlier in June and was arrested in the last days of the month; the complaint was reported to say he had been hired in December 2005 on false records. HSBC said its internal security team had traced the leak, that customers would be fully reimbursed, and that it would press hard for a conviction.
The access came with the job; the question was who had been given it. Nasscom's National Skills Registry, launched in January for exactly that check, did not include him, and HSBC's unit was not a member, sources told IDG News. Nasscom said such crime was not peculiar to India, and in July, meeting the British union Amicus, it rejected the idea that lower pay made Indian staff less honest. HSBC said its Indian centres suffered less fraud than its British ones. Months later the case was reported still under investigation, and the record we could find ends there. India's DPDP Act now exempts contract work done in India on data about people abroad from most of its duties, but not from the one this case turned on: "reasonable security safeguards to prevent personal data breach".
Connectionist temporal classification debuts at ICML
From 25 to 29 June 2006 the International Conference on Machine Learning met at Carnegie Mellon in Pittsburgh, where it had begun as a workshop in 1980. Among its 140 papers, Alex Graves, Santiago Fernández, Faustino Gomez and Jürgen Schmidhuber of IDSIA, near Lugano, introduced connectionist temporal classification, or CTC, their way to "label unsegmented sequences directly" with a recurrent network, without pre-segmented data or a hidden Markov model. On the TIMIT speech corpus their bidirectional LSTM's phoneme error rate was 30.5 per cent, against 35.2 for a context-dependent hidden Markov model and 31.6 for the best hybrid of the two. Rich Caruana and Alexandru Niculescu-Mizil of Cornell compared ten learning methods on eleven problems and found boosted trees, once calibrated, the strongest overall. The week before, at the computer-vision conference CVPR in New York, Raia Hadsell, Sumit Chopra and Yann LeCun of New York University trained twin networks with a contrastive loss that drew similar inputs together and pushed dissimilar ones apart. In 2015 Google put CTC behind its voice search and Android dictation.
EMC agrees to buy RSA; M00P suspects held
On Thursday 29 June 2006 EMC, the Massachusetts storage company, agreed to buy RSA Security, best known for its SecurID authentication tokens, for $28 a share in cash, slightly less than $2.1 billion net of RSA's own cash. It was to become EMC's Information Security Division under Art Coviello, RSA's chief executive, who said threats were moving from the network and its perimeter to "attacks on the data itself". The purchase closed on 18 September; Dell inherited RSA with EMC in 2016 and sold it on in 2020. On 27 June British and Finnish police announced the arrests of three men, aged 63, 28 and 19, in Suffolk, Scotland and Finland, on suspicion of belonging to M00P, a group whose name was embedded in its own malware. The Metropolitan Police's Computer Crime Unit believed they had written and modified viruses to infect computers widely through spam, allegedly aimed at British businesses since at least 2005. The oldest was released without charge; in November 2010 the group's leader, a Scot, was jailed for eighteen months.
⏳ Time capsule — June 2006
- On 1 June Canonical released Ubuntu 6.06, Dapper Drake, the first of the Linux distribution's long-term support releases, supported on the desktop until July 2009 and on servers until June 2011.
- On 3 June Montenegro's parliament declared independence, thirteen days after a referendum in which 55.5 per cent voted for it, just over the 55 per cent required; on 28 June the country was admitted to the United Nations.
- On 23 June Rakesh Roshan's Krrish opened, a sequel to Koi... Mil Gaya with Hrithik Roshan in a double role; it used more than 1,200 visual-effects shots, and its star learned wire work in China from the Hong Kong action director Tony Ching. It became one of the highest-grossing Indian films of the year.
- On 26 June, at the New York Public Library, Warren Buffett signed letters pledging ten million Berkshire Hathaway class B shares, then worth about $31 billion, to the Bill & Melinda Gates Foundation, with five per cent of the remaining balance to be given each July.
A Switch Works Both Ways
The daily call ended on 27 June 2006; the dependence it stood for did not, because a copy of Windows that asks a server whether it is genuine can be given the wrong answer. In the first week of October 2006 the Genuine Advantage team apologised for a server bug that had flagged some systems as non-genuine, and on Friday 24 August 2007 a validation fault ran from mid-afternoon until late the next morning, Pacific time. Microsoft counted fewer than 12,000 systems affected; those caught lost Aero, ReadyBoost and part of Windows Defender's cleaning until they revalidated. Microsoft's emergency switch had been meant to protect owners from a faulty tool. The outages showed the same dependence running the other way.
The other June complaint was about the route: an anti-piracy pilot had arrived as a high-priority update while it was still a test version. The update channel's trust became the prize. Flame impersonated Windows Update in June 2012, poisoned updates carried attackers' code into networks in June 2017 and December 2020, and in July 2024 a faulty update from a security vendor brought down 8.5 million Windows machines. The month's other cases aged into routine: a spreadsheet retrieved from a junk folder let intruders into RSA in March 2011, and the Bangalore case — access a job required, allegedly used for someone else — is the risk that background checks and access logs exist to narrow.