Apple's iPhone went on sale in the United States on Friday 29 June 2007, at $499 for the 4GB model and $599 for the 8GB, each tied to a two-year contract; Apple said 270,000 went in the first 30 hours, and AT&T counted 146,000 activations over the same period. Nobody outside Apple could put software on it. Within days of the launch three researchers at Independent Security Evaluators, a Baltimore firm founded by the Johns Hopkins computer scientist Avi Rubin, began taking the phone apart: Charlie Miller, formerly of the National Security Agency, with Jake Honoroff and Joshua Mason. Finding a flaw took them under three days. Building a working exploit around it took under two weeks — about 215 person-hours in all.
What they found sat in Safari. Apple would later describe it as heap buffer overflows in the PCRE library used by the browser's JavaScript engine: a page carrying the right regular expression could run code of the attacker's choosing. The proof of concept was a website. A phone that opened it copied the SMS log, the address book, the call history and voicemail information and sent them to a server the researchers ran; the same access, they said, could turn the handset into a listening device. They also found the phone would join any wireless access point whose network name and encryption type matched one it had used before, which let an attacker raise a lookalike network with a hostile DNS server and wait.
The deeper finding was architectural. Every running process, the firm said, held full administrative privileges, so taking the browser meant taking everything on the device; the phone also shipped without address randomisation or a non-executable heap, the two defences that make a memory bug hard to turn into dependable attack code. "Security 101 is you limit the amount of information available to the least amount necessary," Miller told The Register. The firm notified Apple in the week of 16 July and went public on Monday 23 July, before any patch existed, telling owners meanwhile to open links only from people they trusted and to join only wireless networks they knew. Apple said it was investigating and would not say whether a fix would come before Black Hat.
It came with two days to spare. On Tuesday 31 July 2007 Apple issued iPhone 1.0.1, the handset's first software update, delivered only through iTunes and carrying no new features: five browsing flaws in Safari, WebCore and WebKit. The advisory credited "Charlie Miller and Jake Honoroff of Independent Security Evaluators" for CVE-2007-3944, the PCRE overflow, and three Adobe Systems researchers and three others for the rest. Jeff Moss, who ran Black Hat, had said Apple had "plenty of time" and that "it would be nice if they patched it." Miller presented the whole finding on Thursday 2 August. Eight months later, at Pwn2Own in Vancouver, he took a MacBook Air through Safari in under two minutes — March 2008.
Fireworks on the Fourth
Around American Independence Day the network behind the Peacomm and Zhelatin family — Storm, to most of the trade — ran another holiday campaign. The mail offered a free e-card from a friend, under subject lines including "America the Beautiful", "Independence Day Celebration" and "July 4th Fireworks Show", and the link pointed at a bare IP address rather than a domain name. Graham Cluley of Sophos said that was itself the warning: the page sat on somebody else's compromised computer, where a script Sophos called JSecard-A tried to fetch Mal/Dorf-C and fold the visitor's machine into the botnet. Its size nobody agreed on. Peter Gutmann, a computer scientist at the University of Auckland, put it at 1 to 10 million machines in a post to the Cryptography mailing list on 31 August; researchers at Mannheim and Eurecom measured 5,000 to 40,000 online at once; IBM's Josh Corman said 6 to 15 million in October, the same week Brandon Enright of the University of California, San Diego told Toorcon he counted a network of about 160,000 with some 20,000 hosts available at any one time, while Bruce Schneier wrote only that he had seen estimates of between 1 million and 50 million. The REN-ISAC had warned in August that scanning an infected machine could draw traffic back. "As you try to investigate [Storm], it knows, and it punishes," Corman said. The estimates never reconciled.
The Man Who Set the Rules
On 3 July 2007 Fidelity National Information Services said an employee of its Certegy Check Services subsidiary, which authorised cheques for merchants and banks, had taken consumer records and sold them to a data broker, which resold part of them to direct marketers. The employee was a senior database administrator whose job was to define and enforce data access rights. The first figure was 2.3 million consumers; on 25 July the company revised it, in filings with the Securities and Exchange Commission, to as many as 8.5 million records — about 5.7 million cheque accounts, about 1.5 million with card details, the rest identifying details. It said it saw "no evidence of the stolen information being used for anything other than marketing purposes." The trail had begun with a retail customer who noticed that a few cheque transactions matched solicitations its customers received. William Sullivan, of Tampa, pleaded guilty, having admitted taking more than 8.4 million records and netting about $580,000. He was serving a 57-month federal sentence in April 2010, when Certegy settled with Florida's attorney general: $850,000 in investigation costs and $125,000 for a state crime-prevention programme.
Twelfth on the List
Sophos's quarterly table of the countries relaying the world's spam, for April to June 2007 and published that July, placed India twelfth, at 2.5 per cent. The United States led at 19.6 per cent, China at 8.4 and South Korea at 6.5; the United Kingdom and Italy tied at 2.8. By continent, Asia had become the largest source at 35.2 per cent, ahead of Europe's 28.5. "While the amount of spam relayed in the U.S. remains high, we're seeing a proportionate rise in other countries," said Ron O'Brien, a senior security analyst at Sophos. India had entered the table in the January-to-March quarter at 2.8 per cent and was off it again by the July-to-September one. The traffic was not Indian spammers but compromised Windows machines in homes, offices and cyber cafés, relaying for somebody else.
That was the shape of India's exposure then. The country was adding telephones faster than almost anywhere and broadband hardly at all: mobile connections passed 200 million in August 2007, four months ahead of the government's target — the first hundred million had taken more than ten years, the second just over one — while broadband stood at 2.56 million against the nine million the Broadband Policy of 2004 had set for the end of that year. The phone on this edition's cover would not be sold in the country for another thirteen months: Airtel and Vodafone brought the iPhone 3G to India on 22 August 2008, at ₹31,000 for the 8GB model. By August 2026 the regulator counted 1,360.70 million telephone connections, 1,101.21 million broadband. The duty to report an incident within hours came much later; our India desk sets out the rule.
Eighteen years to prove a draw
Science published on 19 July 2007 a paper by Jonathan Schaeffer and seven colleagues on the University of Alberta's Chinook project establishing that English draughts, played perfectly on both sides, is a draw. The computation behind the proof had run eighteen years, peaking at about two hundred desktop machines and tapering to some fifty, and had taken on the order of a hundred trillion calculations against a game space of roughly five hundred billion billion positions; the proof itself had closed on 29 April, and the project's own page still puts the finding as "Perfect Play: Draw!". Earlier that month a few hundred robot football teams from dozens of countries met at Georgia Tech for RoboCup, and from 22 to 26 July the AAAI conference convened at the Hyatt Regency in Vancouver, its applications track given over to deployed systems: Fannie Mae's automated underwriting, a neural-network fish inspection rig on Norwegian and Icelandic boats, and the warehouse robots of Kiva Systems, which Amazon bought in March 2012 for $775 million and runs today as Amazon Robotics.
Google pays $625 million for Postini
On 9 July 2007 Google said it had agreed to buy Postini, which filtered business email for spam and malware before it reached the customer's mail server, for $625 million in cash; the deal closed on 13 September. It was the month's largest security deal, putting a search company into the inspection of other firms' correspondence; the service went into Google Apps, and Google announced in August 2012 that Postini's web services would close. On 17 July Symantec released Norton AntiBot, a standalone program licensed from Sana Security that watched running applications for malicious behaviour, not signatures. The approach outlasted the product: AVG bought Sana in January 2009 and Symantec stopped selling AntiBot that year, behaviour monitoring having become a suite feature, not a separate purchase. BitDefender's half-year table of 30 July pointed the same way: its second-largest entry was no named family but a behavioural verdict, 21.4 per cent of all detections. "The gradual change from viruses to trojans on the Top 10 malware lists presents an interesting trend in data security," said Viorel Canja, head of BitDefender Labs.
⏳ Time capsule — July 2007
- On 7 July the Live Earth concerts ran through a day and most of a planet, with more than 150 acts in venues from Sydney and London to Rothera research station in Antarctica. The same evening, at the Estádio da Luz in Lisbon, the New 7 Wonders Foundation named its winners — Chichén Itzá, Christ the Redeemer, the Great Wall, Machu Picchu, Petra, the Taj Mahal and the Colosseum — from a telephone and internet poll UNESCO had already declined to be associated with.
- On 21 July Harry Potter and the Deathly Hallows went on sale: 8.3 million copies in the United States on the first day, better than ninety-six a second, and 2.65 million in Britain. Photographs of all 759 pages of the American edition had appeared online on 16 July, five days early, and Scholastic went to court for a subpoena to identify one source.
- The same day in Dubai, the unfinished Burj Dubai passed Taipei 101's 509.2 metres and became the tallest building in the world. Its builders had reached the 141st level; on 12 September it would pass the CN Tower and every other freestanding structure.
- On 25 July Pratibha Patil was sworn in as India's twelfth President, and the first woman to hold the office, six days after an election she won with close to two-thirds of the vote.
The Same Road In
The architecture the Baltimore report described did not survive. Apple opened the App Store the following July with review and code signing, put applications in a sandbox, took the phone's processes off administrative privileges, and added in later releases the address randomisation and non-executable heap whose absence the report had singled out. What survived was the route. A browser rendering engine reachable from the network, driven by a page the owner chose to open, stayed the main way into a telephone: a flaw in font handling took stock iPhones from a web page in August 2010, and the commercial spyware trade that the reporting of July 2021 laid out was buying exactly that, a message or a page and no touch required.
The month's other two stories ended in the ordinary way. Nobody ever agreed how large Storm was, which is the lesson worth keeping: a botnet population is an estimate, and the honest version of it says whose. Certegy's loss turned on the plain fact that the man selling the records was the man who decided who could read them; separation of duties and the monitoring of privileged accounts are now assumed rather than argued for, and the settlement Florida took in April 2010 required outside assessments for five years. Behind this edition the archive runs back through June 2007 to January 2007.