Microsoft published MS07-017 on Tuesday 3 April 2007, a week before the Tuesday it had planned. The bulletin closed seven holes in the Windows graphics layer at once, most of them local privilege problems; only one was rated Critical, and it was Critical on every supported version of Windows. That was the animated cursor flaw, CVE-2007-0038, which the bulletin noted "is currently being exploited and was previously discussed by Microsoft Security Advisory 935423". The company's reason for moving the date ran to two sentences: "Microsoft is aware of the existence of a public attack utilizing the vulnerability," and "since testing has been completed, Microsoft will release the update ahead of schedule to help protect customers." Windows 2000, XP, Server 2003 and Vista were all Critical.
What the file did was arithmetic. Windows loaded animated cursors through User32.dll and, as the CERT Coordination Center's note of 29 March put it, "fails to properly validate the size of animated cursor file headers": a malformed file carried the tag "anih" and the length 0x24, then a second "anih" with a length of the attacker's choosing, and the copy ran off the end of a stack buffer. Windows Explorer handled files ending .ani, .cur and .ico; Internet Explorer processed them inside HTML, which put the flaw into web pages and into mail. Outlook Express and Vista's Windows Mail were vulnerable, and the SANS Internet Storm Center noted that "Outlook Express users remain vulnerable even when reading e-mail as plaintext". Attackers also gave the cursor files .jpg names, so filtering on the extension missed them.
The campaign that forced the date was unremarkable in every respect but timing. Sophos dated the first run to 30 March, when the mail carried nothing but a link to a Russian site; the lure soon became Britney Spears, one subject line reading "Hot pictures of Britiney Speers". Websense counted more than a hundred hostile sites on 2 April, a tenfold rise on the day before, some of them on domains used in February's compromise of a stadium website. Symantec named a worm using the flaw Fubalca; most of what the exploit dropped stole passwords. In the gap others patched for Microsoft: eEye Digital Security, whose chief technology officer Marc Maiffret argued the bug should have been caught two years earlier, posted a free unofficial fix that stopped Windows loading any cursor file from outside the local system, and the Zeroday Emergency Response Team followed on the Saturday with one that capped the copy at thirty-six bytes. Microsoft's Christopher Budd said customers should "only apply security updates and mitigations provided by the original software vendor".
The dates did not flatter anyone. Alexander Sotirov, a researcher at Determina, had reported the flaw on 20 December 2006, having found it while auditing other code in the same library; Microsoft had fixed a neighbouring animated-cursor bug in January 2005 as MS05-002, and Mark Miller of the Security Response Center conceded that "we're doing an analysis of why we didn't find it then." McAfee told the response centre on 28 March that attacks were running, and the advisory followed the next day. A patch had existed by mid-March, Miller said, but "was still undergoing testing". Sotirov declined to join the complaints: "If you look at the average time it takes them, this vulnerability is not an exception." The emergency fix also stopped four Windows XP applications from starting, and Microsoft was still adding to the list of broken programs on Friday 6 April.
Two Laptops on a Table
Dragos Ruiu announced the idea on the DailyDave list on 20 March, three weeks before CanSecWest opened in Vancouver: two MacBook Pros, fully updated, with no extra security software, on their own wireless network, and whoever took one over could keep it. Nobody got in on the first day, so the organisers loosened the rules. Dino Dai Zovi, who was not at the conference, wrote an exploit overnight in about nine hours; Shane Macaulay put it on a web page, the target visited, and the machine was his. "Shane can have the laptop, I want the money," Dai Zovi said. The money was a $10,000 bounty from TippingPoint's Zero Day Initiative, offered for any flaw used in the contest. It was not the flaw first reported. On 24 April Dai Zovi corrected the record: the hole was in how Apple's QuickTime handled Java rather than in Safari, which put Firefox users with QuickTime installed at risk too. Apple was told on 23 April and patched it in early May. The contest took a name and returned in 2008. The attacks on Estonia began about a week later, on 27 April — May 2007's story entirely.
A Key Out of the Air
Erik Tews, Ralf-Philipp Weinmann and Andrei Pyshkin, working at Darmstadt University of Technology, reported on 4 April 2007 that they could recover a 104-bit WEP key from captured wireless traffic in about three seconds of computation on a 1.7GHz Pentium M. The arithmetic was the smaller half of the result. Earlier attacks needed millions of packets and patience; this one needed about 40,000 for a fifty-fifty chance and about 85,000 for ninety-five per cent, and because the attacker could provoke the traffic by replaying ARP requests rather than waiting for it, the capture took under a minute. The implication Tews drew was about hardware, not mathematics: "we think this can even be done with some PDAs or mobile phones, if they are equipped with wireless LAN hardware." The three presented the work at a conference in Hamburg that weekend. WEP had been known to be weak for years and was still running the tills and scanners of large retail chains, one of which had spent January explaining an intrusion to its customers; by October a second attack would remove the last comfort, that a thief had to be near the shop at all.
A Statute Book Without a Duty
Nothing in India broke that April, which is itself the story. The country had about two and a half million broadband connections — 2.5 million across more than a thousand towns by the end of June, against the nine million the government had set for a year it had declared the Year of the Broadband — and no law obliging anyone who held personal data to protect it or to say when it was lost. The Information Technology Act of 2000 had been drafted for electronic contracts and signatures. The bill meant to repair that, the Information Technology (Amendment) Bill, 2006, had been introduced in the Lok Sabha on 15 December 2006 and sent to the Standing Committee four days later; in April 2007 it was still there. The committee reported on 7 September 2007 and Parliament passed the bill in the last week of December 2008.
What the bill proposed was narrow but novel: a company handling sensitive personal data that failed to put reasonable security measures in place could be made to pay compensation of up to five crore rupees. The gap it left was wider than the hole it filled. As the legislative analysts at PRS put it, "neither the IT Act nor any other law covers how personal information may be collected, processed, shared and used," and the bill compensated unauthorised use without addressing breach of privacy; the Standing Committee's own complaint was that "the issue of unwanted commercial e-mails (spam) has not been addressed." Nineteen years on, both halves of the missing duty exist — the obligation to report, which our India desk sets out, and the obligation to protect, which the DPDP Act now imposes.
Nuance takes speech to the carriers
Nuance Communications closed its purchase of BeVocal on 25 April 2007, six weeks after Microsoft had agreed to buy the rival voice service Tellme Networks — two deals that together moved speech recognition off the desktop and into the telephone network. BeVocal ran self-service customer care for mobile operators, Cingular and Virgin Mobile among its accounts, on terms set out in February: about 8.3 million Nuance shares and some $15 million in cash, around $140 million net of the cash acquired, with as much as $60 million more if targets were met eighteen months on. A hundred and forty-five BeVocal employees took Nuance stock grants. Paul Ricci, Nuance's chairman, had said the deal "expands our position as a leading supplier" of speech to carriers; the consolidation he was running ended in April 2021, when Microsoft agreed to buy Nuance itself for $19.7 billion. Quieter, and in the end further-reaching: on 19 April Google switched on Web History, an opt-in record of the pages a signed-in user had visited rather than only the searches run.
Buying the console, counting the drive-bys
Symantec took ownership of Altiris after the close of business on 6 April 2007, its stockholders having approved the sale two days earlier; the terms agreed in January stood. The Utah company's software inventoried, imaged and patched corporate desktops. The argument was that managing endpoints and defending them had become one job, and it outlasted the brand: the console travelled with Symantec's enterprise business to Broadcom in 2019. In Spain on 24 April, Panda Software sold three-quarters of its shares to the private-equity houses Investindustrial and Gala Capital, ending its founder's sole ownership three months before it renamed itself Panda Security. And at a workshop in Cambridge, Massachusetts on 10 April, five Google engineers published the broadest survey yet of malware on the web: of roughly 4.5 million URLs examined closely, about 450,000 were launching drive-by downloads. Infection, they wrote, had become "pull-based" — the victim fetching the attack. The labelling it describes grew into Safe Browsing.
⏳ Time capsule — April 2007
- On 6 April the Intergovernmental Panel on Climate Change released the Summary for Policymakers of its second working group's report, on impacts, adaptation and vulnerability — the finding that regional climate change was already affecting natural systems on every continent and in most oceans. The same session in Brussels accepted the underlying report; the third working group's summary came on 4 May.
- On 7 April the software developer Charles Simonyi launched towards the International Space Station as the fifth paying visitor to fly there.
- On 13 April Google agreed to buy DoubleClick for $3.1 billion, acquiring the advertising plumbing of most of the web along with it.
- The Cricket World Cup, the first held in the Caribbean, ended on 28 April with Australia beating Sri Lanka in the final at the Kensington Oval in Barbados for a third consecutive title — a match cut to 38 overs a side by rain before the start, decided by 53 runs on the Duckworth-Lewis method, and finished in near-darkness on a ground without floodlights.
What a Cursor Was For
The animated cursor flaw is remembered now for the category it opened rather than the damage it did. Nobody had thought of a cursor as input to a parser; the file sat in the same class as fonts, icons, metafiles and media containers — formats the operating system read before anyone chose to run anything, and the softest surface it had. The fifteen weeks between Determina's report and the patch, and Microsoft's admission that it had missed the bug while fixing its neighbour two years earlier, are the part that aged into policy: disclosure deadlines, bug bounties, and the expectation that a vendor explains its timeline. The gap that mattered most was the other one, between a patch existing and a patch being installed, which is the subject of our WannaCry account.
The month's two briefs both ended by becoming ordinary. Dai Zovi's line — the laptop for his friend, the money for himself — reads in 2026 as the moment paying for exploits stopped being awkward: the Zero Day Initiative paid, the contest became an annual fixture that is still running, and buying vulnerabilities is now a market with vendors, brokers and governments in it. WEP ended differently, by being killed. The Darmstadt result made the key recoverable in a minute, October's attack made the shop irrelevant, and the card industry eventually set dates after which the cipher could not be used at all. Of everything in April 2007, the quietest item has travelled furthest: a bill in a parliamentary committee, proposing for the first time in India that holding someone's data carelessly should cost money.