On Friday 17 August 2007 Amado Hidalgo, an analyst at Symantec, described a program the company had named Infostealer.Monstres. It forced nothing. It signed in to the parts of Monster.com reserved for confirmed recruiters, sent HTTP commands to reach the Managed Folders section, ran automated searches for resumes by country or field, parsed the pop-up windows that returned profiles matching a recruiter's saved searches, and uploaded what came back to a server the attackers controlled. On that server Symantec found more than 1.6 million records — names, email addresses, home addresses, telephone numbers and resume identification numbers — belonging, it said, to several hundred thousand people, most of them in the United States. "Such a large database of highly personal information is a spammer's dream," Hidalgo wrote.
The log-ins were genuine. By Symantec's account they had been taken from recruiters and human resources staff with access to the "Monster for employers" areas, and the queries arrived from many addresses at once, hard to pick out of Monster's own traffic. Symantec told the company which accounts were being used, to be disabled. On Sunday 19 August a Monster spokesman, Steve Sylven, said: "We are investigating the reports related to this Trojan and will take any necessary steps indicated by that investigation." He defended the searching — a large customer's use of the database can look like scripted access, and telling one from the other is difficult — and said credentials had been stolen and used against the site before. He could not confirm whether these accounts had been shut off.
What the records were for arrived in the inbox. The phishing mail built out of them opened with the recipient's full name, the detail that makes a stranger's letter read like a real one. One run advertised a "Monster Job Seeker Tool", a product that did not exist, and delivered Trojan.Gpcoder.E, which encrypted the victim's files and left a text file demanding payment. Another offered a transfer manager's post at an investment firm — work from home, a $500 signing bonus — on condition that the applicant open a Bank of America account and hand over its details, from which money could be drawn by Western Union. "The email looks very realistic," said Vikram Thakur of Symantec, "and may convince many that it has been sent from Monster.com or Careerbuilder.com."
Monster shut the server down. On Wednesday 22 August it told users it was still investigating and would "take measures to address the impact" of Infostealer.Monstres, and posted a new security alert; its release said the data on the server "was limited to names, addresses, phone numbers and email addresses". In the last week of August it began writing to an estimated 1.3 million people — the number whose contact details it said it had found on the attackers' server, short of Symantec's 1.6 million because many users had posted more than one resume. On Wednesday 29 August the chief executive, Sal Iannuzzi, said that "protecting the job seekers who use our website is a top priority at Monster". The same day the Office of Personnel Management said 146,000 of the two million subscribers to USAJOBS.gov, whose technology Monster supplied, were affected — contact details only, it said, and no Social Security numbers. Monster said it had contacted law enforcement; the record of the time does not say what came of that.
A Flood of Log-Ins
Skype's network, by its own account, "became unstable and suffered a critical disruption" on Thursday 16 August 2007, and the service was "unavailable to the majority of its users for approximately two days". The first explanation blamed a "routine software update"; the fuller one named it, saying the trouble began with "a massive restart of our users' computers across the globe" after they received "a routine set of patches through Windows Update". The restarts drained its resources, and "this caused a flood of log-in requests, which, combined with the lack of peer-to-peer network resources, prompted a chain reaction that had a critical impact". Normally, Skype said, the network "has an inbuilt ability to self-heal", but the event "revealed a previously unseen software bug within the network resource allocation algorithm" — a deficiency, an earlier note had said, in an algorithm within its networking software. Skype said no malicious act of any kind was involved and that users' security had never been at risk. Microsoft would not wear the implication: Christopher Budd of its Security Response Team wrote that the company had looked, and "we found that there were no issues introduced by the security updates themselves". Skype's Villu Arak then clarified — "We don't blame anyone but ourselves" — calling the patches a catalyst rather than the root cause. What the explanation never addressed, as LWN's Jake Edge pointed out on 22 August, was why patches issued on a Tuesday brought the network down on a Thursday. Service came back on the Saturday.
What an Apostrophe Did
On Sunday 12 August 2007 the pages carrying the United Nations Secretary-General's speeches returned, instead of the speeches, a hackers' signature and a message about United States and Israeli policy. It was, as The Register put it, "more subtle than a straightforward front page defacement": the home page itself was not the target. Giorgio Maone's blog Hackademix, which recorded the defacement that day, showed the route in a single character. Appending an apostrophe to a parameter in the URL — statID=105' — made the speeches page, an ASP script, answer with SQL errors. "If only prepared SQL statements were used properly," Maone wrote, "this embarrassing incident would have been easily prevented" — properly meaning constant statement strings and type-checked bound parameters, available, he noted, even in the obsolete ASP "Classic" and ADODB arrangement the site was running. The speeches were restored that Sunday afternoon and UN technical staff were reported to have patched the main flaw. Hackademix did not agree. On 13 August, it wrote, the most obvious hole had merely been hidden and could be exploited again; by that afternoon the main site was still open and the UN Environment Programme's pages still carried the defacement. A reader raised an ECOSOC page at the end of the month, and Maone answered that it was "one of the many holes still open".
A Frame on the Home Page
At the end of August 2007 the Bank of India's home page began serving malware to everyone who loaded it. Sunbelt Software reported it on Thursday 30 August: a rogue IFRAME sent visitors to a server elsewhere. F-Secure traced the chain: the hidden frame loaded a file from another site, which in turn called three more addresses, two of them already dark; the third served obfuscated JavaScript that used browser exploits to fetch and run a downloader, loader.exe, which pulled in the rest. Roger Thompson of Exploit Prevention Labs matched one exploit to MS06-042, a Microsoft bulletin from the previous year, and called the code "pretty much a cut-and-paste of the original proof-of-concept that was put out on Metasploit last July" — July 2006. Sunbelt counted thirty-one separate pieces of malware, among them the password stealer Pinch, rootkits and spam bots.
The site went down on the Friday behind a notice: "This site is under temporary maintenance and will be available after 09:00 IST on 1.09.07." It did not keep that appointment. A senior employee, speaking anonymously to Computerworld, said each time administrators rolled the index page back the attackers put the frame back; the site was hosted outside the bank by an American company, since replaced, and online banking ran in-house on servers managed under contract by Hewlett-Packard and was unaffected. Sunbelt's chief executive, Alex Eckelberry, disputed that — visitors reached online banking through links on the home page — and said all the clues pointed to the Russian Business Network in St Petersburg: his judgement, not a finding. The page returned on Tuesday 4 September with a pop-up: "SITE HAS BEEN RESTORED AFTER MAKING IT SAFE FOR CUSTOMERS TO VISIT WITHOUT WORRY!!!!!" Nothing in the reporting says any account or record was taken; the harm ran through the visitor's own machine.
Thirty-six teams cleared for Victorville
On Thursday 9 August 2007, after site visits across the country, the Defense Advanced Research Projects Agency named thirty-six teams to the semi-final round of its Urban Challenge, the National Qualification Event set for 26 to 31 October at the former George Air Force Base at Victorville, California. This was not the desert crossing of the earlier Grand Challenges: an empty vehicle had to cover sixty miles of mock town inside six hours, merging into traffic, taking its turn at junctions, handling traffic circles and obeying California road law. Among the thirty-six was Stanford's Junior, built by the engineers who went on to start Google's self-driving programme, now Waymo. Mid-August also settled a succession in robot football: with Sony no longer making the Aibo, the RoboCup league built around it took Aldebaran's humanoid Nao instead, the two sharing the pitch in 2008 before the Nao stood alone from 2009. Contenders in Netflix's recommender contest compared notes on 12 August at the ACM's knowledge-discovery conference in San Jose.
Two suites and seventeen scanners
On Tuesday 28 August 2007 Symantec put the 2008 Norton line on sale, at prices unchanged from the year before. The new part was Browser Defender, which watched ActiveX, JavaScript and VBScript inside Internet Explorer and inspected the API calls attack code was about to make rather than unpicking its obfuscation; Ed Kim, a director of product management in the consumer group, called it "zero-day protection in the browser". It covered no other browser at launch. SONAR, the behavioural engine Symantec had been handing 2007 subscribers as a free add-on, was built in. Kaspersky Lab had opened the month on 2 August with the English release of Anti-Virus 7.0 and Internet Security 7.0, certified for Vista and sold on a heuristic analyser that judged unknown programs by what they did. Andreas Clementi's fifteenth AV-Comparatives report, on test-beds frozen 3 August, ran seventeen home-user scanners; about a third of its main set was missed by at least one of them, and several crashed, hung or silently skipped samples. Reading conduct rather than counting signatures is what the endpoint market now sells.
⏳ Time capsule — August 2007
- On 2 August the crewed submersibles Mir-1 and Mir-2 reached the seabed beneath the geographic North Pole, Mir-1 at 4,261 metres and Mir-2 at 4,302. Mir-1's crew — the pilot Anatoly Sagalevich, the polar explorer Artur Chilingarov and the businessman Vladimir Gruzdev — left a metre-long titanium Russian flag and a time capsule on the bottom. The foreign minister, Sergey Lavrov, said the object was "not to stake Russia's claim but to show that our shelf reaches to the North Pole".
- On 8 August at 22:36 UTC Endeavour lifted off from Launch Complex 39A on STS-118 with Barbara Morgan aboard, twenty-one years after she had been Christa McAuliffe's backup for the Teacher in Space project. Foam from the external tank had gouged a tile behind the right landing gear door, about three and a half inches by two; managers decided on 16 and 17 August to leave it alone, and with Hurricane Dean turning towards the Gulf the orbiter came home a day early, landing on 21 August.
- On Thursday 9 August BNP Paribas suspended dealing in three funds holding American subprime paper, saying it could no longer value them. The same day forty-nine banks borrowed €94.8 billion from the European Central Bank in a one-day operation priced at 4 per cent — the first intervention of its kind since the days after the September 2001 attacks in the United States. Several histories of the financial crisis start from that Thursday.
- On 13 August a draw at The Oval gave India a 1–0 Test series win in England, their first there since 1986. Set 500, England finished on 369 for six, Kevin Pietersen making 101; India's first-innings 664 was their highest Test total against England, and Anil Kumble, in his 118th Test, made 110 not out, the only century of his career.
Credentials That Work
What made August 2007 worth keeping is that the method aged so well. Nothing at Monster was forced; a program arrived holding keys that had been cut for someone else, and the site's own search tools did the rest. The company wrote to about 1.3 million people; the Office of Personnel Management counted 146,000 on the federal jobs site Monster ran; in January 2009 the British site gave up log-ins, contact details and basic demographic data — on as many as 4.5 million accounts by The Times's count, a figure Monster would not confirm. Nineteen years on, the working log-in is the commodity the criminal economy trades in, stolen in bulk by information-stealing malware and sold on, and a credential nobody revoked is still the shortest way into a large organisation — as the American fuel pipeline shut in May 2021 found out.
Sylven's defence — that a recruiter searching in bulk looks much like a script — named the problem that has not gone away: not whether a credential is valid, but whether the behaviour behind it belongs to whoever it was issued to. Skype's account, a resource-allocation bug exposed by a world rebooting at once, became the shape of the modern outage, and the network did not last: Microsoft set 5 May 2025 as the day consumer Skype would close, moving its users to Teams. The UN's speeches came back the same afternoon; the query behind them was still open at the end of the month, which is not the same as fixed. And the Bank of India's frame was the model for what followed: a trusted site borrowed to reach the browsers that trusted it.