The flood arrived, in ICANN's own description, like a brick wall. It began on Tuesday 6 February 2007 at 12:00 UTC — four in the morning on the American west coast — and ran for about two and a half hours. Three and a half hours after it stopped, a second attack began and ran for five more. The packets were mostly malformed DNS queries aimed at port 53, and the traffic appeared to come from the Asia-Pacific region. ICANN's factsheet, version 1.1, dated 1 March 2007 and announced on 8 March, said at least six of the thirteen root identities were attacked and two badly affected: the g-root, run by the United States Department of Defense, and the l-root, run by ICANN itself from California.
What ICANN did about its own server is the most concrete thing on the record. Steve Conte, presenting for ICANN's l-root, told a meeting of DNS operators later that year that it was then "a unicast (one instance) network" — one address, one place — and that a replacement cluster had already been built and was due to go live the week after the attack. The organisation split in two. One team stayed with the flood and the old machine, worked alongside the other root operators and carried information up to executive staff. The other travelled to the new site and brought the cluster up through some BGP route flaps; it "immediately soaked the attack and still handled real queries".
The legacy instance was switched off once the new cluster settled, and the replacement, Conte said, carried more than ten times the capacity. The other roots had made that move years earlier. Anycast lets a single address be answered by many machines in many places: the f-root alone stood behind 42 locations, and the Internet Systems Consortium, which runs it, said its global nodes and its local Asian nodes degraded during the first two hours while the rest were untouched — f-root then answering more than 15,000 queries a second from 40 sites in 32 countries. The RIPE NCC reported that two root servers stopped answering up to 90 per cent of queries. Resolvers cache; most people typed an address and got a page.
Almost every first account was wrong. In July 2007 John Kristoff of Neustar Ultra Services read the cuttings back to the DNS operators — all thirteen attacked, three, five, six — and gave the list as four roots, F, G, L and M, three .info servers and a set of hosts nobody had heard of. Even ICANN's factsheet, he said, was imprecise on who got hit, the duration and the packet detail, and K-root, widely credited with having held the internet up, had not been attacked at all. The botnet was small: about 4,500 to 5,000 Windows machines, roughly 65 per cent in South Korea, an HTTP controller in the United States, three threads per victim set to run 24 hours, addresses not spoofed. The motive was never established.
A Flag From 1994
A researcher using the name Kingcope made a way into Solaris public on 10 February 2007, and the CERT Coordination Center published a note two days later. The telnet daemon accepted authentication information in the client's USER environment variable, handed it to login unsanitised, and login would make unsafe assumptions about what it had been given; a stranger could skip authentication and arrive as somebody else. On many default installations root was out of reach; adm and lp were not. Sun issued a workaround on 12 February and patches the next day; Solaris 10 was affected, 8 and 9 were not. The trick was thirteen years old: a Bugtraq post of 1 August 1994 reported that rlogin with -l -froot gave root on "any AIX 3.2.X machine", fixed under IBM's APAR IX44254. On 28 February US-CERT issued a technical alert: a worm was using the flaw, logging in as adm or lp, opening a backdoor shell on port 32982, rewriting both accounts' crontabs and scanning port 23 for the next host. Sun published an inoculation script; US-CERT said it guaranteed nothing and a rebuild from trusted media might be needed.
A Line in the Header
Super Bowl XLI was played at Dolphin Stadium in Miami Gardens on Sunday 4 February 2007. Two days before the game Websense published an alert: the stadium's website, the Miami Dolphins' own site and a mirror at proplayerstadium.com each carried, in the front page's header, a link to malicious JavaScript that ran when the page rendered. It reached for two Windows flaws Microsoft had already fixed — one in April 2006, one in January 2007, according to Computerworld's account — and, where it found them, sent the browser to a second web server, reported to be in China, which installed a downloader and a password stealer. Websense's automated tools had flagged the site on 26 January; its engineers learned of it only when customers rang to ask why they could not reach the page. Dan Hubbard of Websense said anyone who had visited in the previous week might be infected. The team's spokesman, George Torres, confirmed the compromise, said the sites had been cleaned by that Friday afternoon and that all the code was being reviewed. Within days the same script was being found on health care and government sites.
Three of Thirteen, in Noida and Madras
When the root was flooded on 6 February 2007, three of the thirteen identities were answering from machines inside India, and one of the three was among the four later named as attacked. On 26 August 2005 the RIPE NCC, working with APNIC, announced a k-root instance at the National Internet Exchange of India's site in Noida; a NANOG post the same day recorded f, i and k anycast instances at three NIXI points of presence — Delhi, Bombay and Madras, with Calcutta left out — and quoted the communications minister, Dayanidhi Maran, on the negotiation: "we fought hard and got three". Paul Wilson of APNIC and Axel Pawlik of the RIPE NCC were in Delhi that week for the meeting that settled it.
The network engineer Anurag Bhatia reported in April 2012 that users outside Chennai could not reach the f-root node there, because NIXI's policy had Indian providers announce only their regional routes there, leaving no return path; ISC switched the instance off, and Indian queries went to Hong Kong instead, at about 340 milliseconds. That October he found the same fault at the i-root node in Mumbai, which Netnod took down, leaving k-root in Delhi to carry the load alone. The country rebuilt from there: NIXI announced India's first m-root instance at NIXI Mumbai, live by 10 June 2024, with a Hindustan Times count putting India past forty instances as of 2022. The machines were the easy part, as they often are; the routes took most of two decades — the gap our India desk traces in the six-hour reporting requirement.
A C compiler for the graphics card
NVIDIA released the public beta of its CUDA software development kit and C compiler on 16 February 2007, for the G80 processor in the GeForce 8800 and for Windows XP and one build of Red Hat Linux. Andy Keane, the company's general manager of GPU computing, said the graphics processor had become "a powerful, programmable processor that is ideally suited for computationally intensive applications" — an understatement, since nearly every large neural network trained since has run on that toolkit's descendants. On 26 February Microsoft announced an agreement to buy Medstory, a small Foster City firm whose health search technology it placed in its new Health Solutions Group; terms were not disclosed. Current Biology's issue of 20 February carried work by John-Dylan Haynes and colleagues in Leipzig, London and Tokyo, in which a multivariate pattern classifier read functional MRI scans and identified, about seven times in ten, whether a volunteer had privately decided to add or to subtract.
Four failures in the Vista round
Virus Bulletin's comparative review of anti-virus products on Windows Vista, reported on 5 February 2007, failed four of the fifteen products submitted; the magazine named Microsoft's own Windows Live OneCare and McAfee's VirusScan among them, and since it tests free of charge it allows no re-test. John Hawes, its technical consultant, said there was "no excuse for security vendors" not to have got their products right by then, Vista having been so long delayed. The commercial argument ran the other way all month: a Gartner forecast reported on 9 February put worldwide security software revenue above nine billion dollars for 2007, with anti-virus still more than half of it, yet the analyst quoted expected the move to converged endpoint suites to be a long one. On 26 February Symantec shipped the first Norton 360, begun as Project Genesis, which folded backup, tuning and phishing protection around the scanner and was the first Symantec product to carry SONAR, watching what programmes did rather than matching signatures — the direction the industry took.
⏳ Time capsule — February 2007
- On 2 February the Intergovernmental Panel on Climate Change published the summary for policymakers of the first volume of its fourth assessment, finding most of the warming since the middle of the twentieth century "very likely" the result of human greenhouse gas emissions — on the panel's own scale, a probability above 90 per cent, arrived at by expert judgement.
- On 11 February Vodafone agreed to buy a 67 per cent holding in Hutchison Essar for $11.1 billion; the same day Hindalco agreed to buy Novelis for about $6 billion, and on 14 February the Bombay Stock Exchange sold 5 per cent of itself to Deutsche Börse.
- On 20 February the Australian federal government announced that it would legislate most incandescent bulbs out of the shops by 2010, with a minimum efficiency of 15 lumens per watt; imports of non-compliant lighting stopped in November 2008 and retail sales in November 2009. New Zealand proposed something similar the same month.
- On 25 February The Departed won four Academy Awards, among them best picture and best director for Martin Scorsese; Forest Whitaker won best actor and Helen Mirren best actress, with Alan Arkin and Jennifer Hudson in the supporting categories.
The Names That Are Not Machines
The rest of the root moved. ICANN's factsheet listed D, E, G, H and L as the identities still without anycast; Conte's presentation named Miami as l-root's first anycast location. Today the thirteen names stand behind hundreds of instances, and India alone has more than forty. The next landmark attacks on the plumbing did not come at the root. One was the cache-poisoning flaw of July 2008, which went after what resolvers believed rather than whether the root would answer; the other was the flood on a managed DNS provider in October 2016, which took large parts of the web's names off the air without touching a root. February 2007 showed the root had been made redundant enough; what followed showed it was no longer the place worth attacking.
The telnet flag outlived its operating system. Sun's patch closed the Solaris hole in a day, Sun shipped an inoculation script for the worm, and telnet has been off by default and displaced by SSH for most of two decades. The flag came back anyway. On 21 January 2026 an advisory for GNU InetUtils described the same mechanism in its telnet daemon — the client's unsanitised USER value handed to login, a leading -f read as the instruction to skip authentication — in every release from 1.9.3, shipped in May 2015, to 2.7. Thirty-two years after the AIX report, the same two characters. The stadium website, by contrast, was cleaned by Friday afternoon: the shortest ending in the edition, and the only one that stayed ended.