The message reached the Full-Disclosure and Bugtraq lists on Wednesday 22 March 2006 under the subject "IE crash": a checkbox on a web page, a line of script calling a method named createTextRange() on it, and a note that Internet Explorer jumped to a random address. "I can't find any info on this delicious IE bug, but it seems to be publicly known," its author wrote. It was known, though not publicly: Andreas Sandblad of Secunia had found the flaw on 10 February and reported it on the 13th, and Microsoft had confirmed it on the 21st. The crash was memory corruption that could steer the browser into code an attacker had left on the heap. Secunia published the next morning, rating it highly critical, and Microsoft issued Security Advisory 917077 the same day.
Microsoft's advice was to turn off Active Scripting, which the attack needed. By Friday 24 March a proof of concept that opened the calculator was circulating, and the SANS Internet Storm Center raised its Infocon to yellow "for the next 24 hours", the first such alert since the metafile emergency of the New Year; before the day was out it had a report of a minor site using the flaw to install a Spybot variant. By the Saturday it had reports of more than a hundred hostile sites and by the Monday more than two hundred, while Microsoft went on describing the attacks as limited. By the end of the month Websense was warning of spam carrying excerpts of BBC news stories, whose "read more" link led to a forged BBC page that used the flaw to install a keylogger watching financial websites.
Lorna Hutcheson of the Storm Center followed one chain from a hacked page to a downloader and then to a file called calc.exe, which stole passwords and browsing history and sent them out by FTP; when its drop server changed, she judged it easier for the attacker to swap the program than to revisit every hacked site. On Monday 27 March eEye Digital Security posted a free fix that blocked access to the vulnerable component, made at its customers' request and offered to anyone; eEye presented it as temporary protection rather than a replacement for Microsoft's forthcoming patch, built it to remove itself when that patch arrived, and advised installing it only where Active Scripting could not be turned off. Late that day eEye published the patch's source code, and Determina released a second fix, its source also open to review.
Microsoft declined to recommend eEye's fix because it had not been able to test it, and Stephen Toulouse of its Security Response Center wrote that the company was working "day and night" on a cumulative update for Internet Explorer, due on 11 April or sooner if the attacks warranted. The Storm Center, which had vouched for an unofficial patch in January, held back: "We have not been able to vet the patch," it wrote on 28 March, and with Active Scripting switched off there was a workaround this time. No early release came: MS06-013 arrived on schedule on 11 April, closing ten holes and noting that this one was being exploited. Its file tables date the repaired mshtml.dll for Windows XP Service Pack 2 to 23 March, the day of the advisory.
A Laptop Off-Site
On Wednesday 22 March 2006 Hewlett-Packard confirmed that a laptop belonging to Fidelity Investments, which provided services to HP, had been stolen while several Fidelity employees were using it at an off-site location. It held the names, addresses, Social Security numbers, dates of birth and other employment-related information of 196,000 current and former HP employees, though not the personal identification numbers needed to log on to Fidelity's services. Fidelity's spokeswoman, Anne Crowley, said the theft had been reported to the police, who had told the company of several laptop thefts that appeared to be "largely property-focused, rather than people seeking data or identity information." The data could be opened only with a special application that had expired a day or so after the theft, she said, and would be "difficult to interpret and generally difficult to read or use." Both companies began writing to the people affected that week, and Fidelity offered a year of credit monitoring at no cost. It said there was no evidence the information had been misused.
The Surest Measure
At his press conference on 15 March 2006 Japan's chief cabinet secretary, Shinzo Abe, made an unusual appeal: the surest way to stop leaks, he said, was not to use Winny, a file-sharing program, on a PC at all, and he asked the public to stop. Government employees had already been barred from it at work and were warned against it at home, above all on computers they also used for work. The cause was Antinny, a virus that travelled on Winny. It renamed itself after the photos or music people were likely to be searching for, in a name long enough to push the file extension out of view, then offered random files from the infected disk to the network — and work carried home went with them. A Japan Airlines co-pilot's computer had leaked passwords for restricted areas at sixteen airports in Japan and at Guam's; in early March the National Defense Agency said it had lost "confidential information", again from an employee's home computer. The agency later said it would buy 56,000 computers so staff need not use their own.
Counting Open Doors
In March 2006 the Indian Computer Emergency Response Team became a general member of APCERT, the forum of the Asia-Pacific region's computer emergency teams, according to its own annual report for the year, dated 31 March 2007. CERT-In was a little over two years old: FIRST, the global forum of incident response teams that it joined before the year was out, gives its date of establishment as 19 January 2004. On 23 March, the day of Microsoft's advisory, it issued vulnerability note CIVN-2006-0028 on the createTextRange flaw, rated High, with Microsoft's own workaround: "Disable active scripting or configure Internet Explorer to prompt before running Active Scripting." The note said nothing of the attacks or of the unofficial patches, and an update on 15 April pointed readers to MS06-013.
Its counting is the more revealing record. March was the month CERT-In found the most open proxy servers in India — 449 of the 1,837 it tracked in 2006, machines that would relay anyone's traffic — and it alerted their administrators "in order to reduce spamming and other malicious activities originating from India". Across the year it handled 552 incidents, against 254 in 2005 and 23 in 2004. Of those, 339 were phishing, 76 per cent of it aimed at e-commerce, but Indian financial institutions were involved in only about 2 per cent of the phishing cases; the rest concerned institutions abroad. CERT-In's report for 2023 counts 15,92,917 incidents handled, and the fraud now reaching Indian households is made for them, down to the uniformed "officer" on a video call that our India desk takes apart.
Nuance completes its purchase of Dictaphone
On 31 March 2006 Nuance Communications completed its purchase of Dictaphone, agreed in February, and set up a Dictaphone Healthcare Division with Rob Schwager, who had run Dictaphone, as its president. The study of how people and robots work together got a conference of its own: the first annual Conference on Human-Robot Interaction, sponsored by the ACM, met in Salt Lake City on 2 and 3 March, and its programme took 41 of the 140 full papers submitted; in 2026 the series met for the twenty-first time, in Edinburgh. At Stanford, from 27 to 29 March, the AAAI's eight spring symposia included one on human-robot teams and another on what had gone wrong in AI research and applications, and why.
McAfee calls Excel a virus; Claria leaves adware
On Friday 10 March 2006 McAfee issued definition file 4715, and on-demand scans using it began reporting legitimate programs as W95/CTX, a low-risk Windows 95 virus: Microsoft Excel among them, with parts of Adobe's update manager, Macromedia's Flash Player and the Google Toolbar's installer. File 4716 corrected the error but could not undo it. Quarantined files could be put back, and by 14 March McAfee had a tool for it; where administrators had chosen deletion, the files were gone. One organisation told the SANS Internet Storm Center of more than 3,700 quarantine events. In April 2010 another McAfee file would quarantine a core part of Windows itself. On 21 March Claria, formerly Gator, said it would leave the adware business by June and had hired Deutsche Bank Securities to sell its adware assets, to a buyer bound by privacy watchdogs' standards; Dave Kramer, a lawyer who had acted in adware suits, said the right course was to "shut down the operation, not sell it to somebody else". In June Claria told users GAIN would stop working on 1 July.
⏳ Time capsule — March 2006
- On 10 March NASA's Mars Reconnaissance Orbiter fired its six main engines for 27 minutes and was captured into orbit around Mars. Twenty years later it is still working there, far beyond its design life.
- On 12 March, at the Wanderers in Johannesburg, Australia made 434 for 4, the first total above 400 in a one-day international, and South Africa passed it with a ball to spare, winning by one wicket with 438 for 9.
- From 15 to 26 March Melbourne held the Commonwealth Games, opened by the Queen at the Melbourne Cricket Ground, with 4,071 athletes from 71 nations. Australia won 84 golds and 221 medals in all; India finished fourth, with 22 golds among its 50.
- On 29 March a total eclipse of the Sun crossed from Brazil over the Atlantic, West Africa, the Sahara and Turkey to Mongolia, with totality lasting up to 4 minutes 7 seconds. Libya built a tent village for 7,000 people at Waw an Namus in the Sahara, open only to astronomers.
Nineteen Days
The createTextRange flaw left the argument January had opened where it found it. Two companies fixed Internet Explorer before its maker did, both with their source code open to inspection, and Microsoft still shipped on the second Tuesday, nineteen days after its advisory, having spent them, by its own account, on testing. The schedule did not always hold afterwards: Microsoft broke it for the animated-cursor flaw in April 2007, when eEye again patched first, and in January 2010 shipped an Internet Explorer fix out of band, nineteen days early. The browser has since gone — support for Internet Explorer 11 ended on 15 June 2022 for the mainstream releases of Windows 10 — though Microsoft has committed to supporting Internet Explorer mode in Edge at least through 2029.
The month's two briefs were about files that left the building, and they ended less tidily. The record says no more of Fidelity's laptop; the one stolen in May held more than a hundred times as many records. Winny's ended in court, though the leaks were never the charge: its developer, Isamu Kaneko, arrested in 2004, was convicted in Kyoto in December 2006 of assisting copyright infringement, acquitted on appeal in 2009, and cleared in December 2011, when the Supreme Court agreed that prosecutors could not prove he meant the program for illegal use. "Reports of the leaks make for good drama," Kazuhiko Kato, a computer scientist at Tsukuba University, said that June. "Still, they show that people need to be careful if they connect their computers to the Internet."