Nothing about the pages looked wrong. A visitor to an Italian hotel's website that June saw the hotel's own photographs and tariffs; the only change was a short block of JavaScript and an inline frame near the bottom of the HTML, which fetched a page from somewhere else and ran it out of sight — some straight at the attack server, some at an intermediate machine that forwarded the browser on. Researchers began tracking the compromises late on Friday 15 June 2007, and by the Monday Websense, a San Diego company, put the number of affected sites at about 10,000, its own estimate, not an audit. Trend Micro listed the victims by trade: tourism and hotels, the automotive industry, film and music, tax and employment services, city councils.
What the frames pointed at was a product. MPack was written in PHP and kept its records in MySQL. It read the visitor's HTTP request headers to work out the operating system and browser, assembled an exploit set to match with the most recent flaws first, ran them in order until one worked, and installed whatever its buyer had chosen. It shipped with a graphical management console, password-protected, which showed how many victims an installation had taken and broke them down by country, operating system and browser. Panda Labs put the kit at about $700 with exploit modules at $50 to $150; the iDefense analysis circulated by the SANS Internet Storm Center on 20 June 2007 priced a complete kit between $500 and $1,000, and a loader alone at $300.
Two things made it unusual in 2007. It came with technical support, and with updates: when a new browser flaw appeared, paying customers got a module, and the authors charged extra to keep the files unrecognisable to anti-virus software. Version .90's list ran through half a dozen Microsoft bulletins — among them the animated-cursor flaw patched out of band that April — plus overflows in WinZip's ActiveX control and QuickTime. Its effectiveness was an advertisement, not a measurement: the author claimed a 45 to 50 per cent success rate, and Ken Dunham of iDefense recorded that MPack claimed "about 50 percent success in attacks silently launched against Web browsers". Symantec's Hon Lau put it plainly: "the criminals are taking full advantage of the online world to generate their ill-gotten gains".
The numbers did not agree. iDefense reported more than 80,000 addresses behind one attack and more than 2,000 new victims reporting to a single control site in a few hours — measures that do not reconcile with the 10,000 sites counted in the press. How the sites had been reached was an inference: most shared a hosting provider, and the likely route was an exploited control panel, not ten thousand break-ins. Symantec said only that the cause was "most likely some vulnerability or configuration issue at the ISP/hosting level". One payload was Torpig, served from a machine on the St Petersburg network profiled that October. Panda Labs traced its sale to a Russian group from December 2006; iDefense named the seller by handle. Nobody was charged over the Italian campaign.
The Unclassified System
The Pentagon took an unclassified email system serving the Office of the Secretary of Defense off the network on the afternoon of Wednesday 20 June 2007, and the next day Robert Gates, the defense secretary, confirmed the intrusion to reporters. "A variety of precautionary measures are being taken," he said. "We expect the system to be online again very soon." He played the disruption down — "We obviously have redundant systems in place, and there is no anticipated adverse impact on ongoing operations" — while allowing "some administrative disruptions and personal inconveniences", and said the department saw perhaps hundreds of attacks a day. Press accounts put the number of email accounts cut off at as many as 1,500; Gates did not confirm a figure, and no count was published. The department named no culprit and did not say whether the intruder had read anything; the system reportedly held no information relating to military operations. Asked whether his own mail had been touched, Gates answered: "I don't do email. I'm a very low-tech person." The argument over who had been inside began with a newspaper report that September.
A Million Addresses
The FBI said on 13 June 2007 that an operation called Bot Roast had identified more than a million compromised machines — its own figure, built from victim addresses, not from examining the machines, and headlined as potential victims. Carnegie Mellon's CERT Coordination Center was helping notify the owners. "The majority of victims are not even aware that their computer has been compromised or their personal information exploited," said James Finch, the FBI's cyber division assistant director. Robert Alan Soloway, arrested in Seattle on 30 May 2007 on a thirty-five-count indictment, was accused of using hijacked computers to spam for his own site. James C. Brewer of Arlington, Texas, was indicted in Chicago over more than 10,000 computers compromised between October and December 2006, two in hospitals near the city, where the indictment said machines repeatedly froze or rebooted, delaying medical services and costing a thousand hours to clean up. Jason Michael Downey of Covington, Kentucky, was charged over denial-of-service attacks run through an IRC server. Soloway pleaded guilty to three counts on 14 March 2008 and was sentenced on 22 July to forty-seven months. A second round followed in November.
A Registry Instead of a Law
India's first national answer to unsolicited commercial communication came that month from the telecom regulator, not from the IT Act. The Telecom Unsolicited Commercial Communications Regulations, 2007 were notified in the Gazette on 6 June 2007, after complaints from credit-card subscribers and observations by the Delhi High Court in a public interest litigation. The mechanism was a list: every operator was to keep a private do-not-call list and upload it to a National Do Not Call Registry run by the National Informatics Centre, against which telemarketers' calling lists would be scrubbed. Registration with the Department of Telecommunications became compulsory under guidelines of the same date, at Rs 1,000 per telemarketing centre, with 31 August 2007 as the cut-off for firms already trading, after which carriers were to withdraw their lines. The Reserve Bank of India followed on 3 July 2007, telling commercial banks to engage no telemarketer without a departmental certificate.
The month's other Indian number was not a choice. The Anti-Phishing Working Group counted 31,709 unique phishing sites in June 2007 and, as its figures were reported, placed India sixth among the countries hosting them at 2.84 per cent, behind the United States, South Korea, Poland, Russia and Bangladesh — a count of Indian servers pressed into service, not of Indian victims. Two months later the kit on this month's cover was turned on an Indian bank's own website. Read in 2026, the June regulations are the first half of a long argument: the registry was judged ineffective and rewritten in 2010 and again in 2018, while the duty to report an incident at all came much later, in the rule our India desk sets out.
Machine learning meets at Oregon State
The twenty-fourth International Conference on Machine Learning met at Oregon State University in Corvallis from 20 to 24 June 2007, held in conjunction with that year's inductive logic programming conference, and its programme now reads like a contents page for the decade after. Hugo Larochelle, Yoshua Bengio and three colleagues put deep architectures through an empirical comparison; Rajat Raina, Andrew Ng and three co-authors set out self-taught learning, borrowing structure from unlabelled data; Shai Shalev-Shwartz, Yoram Singer and Nathan Srebro presented Pegasos, a sub-gradient solver that made support vector machines cheap to train on large sets; and Andriy Mnih and Geoffrey Hinton offered three graphical models for statistical language modelling, Ruslan Salakhutdinov joining them to fit restricted Boltzmann machines to collaborative filtering, the recommender problem the Netflix contest had made fashionable. Four papers took the best student paper awards, among them information-theoretic metric learning. On 5 June 2007 Google bought PeakStream, a Redwood City firm whose tools let one program run across x86 chips, graphics processors and the Cell — the hardware route the field eventually took.
Forefront passes, Kaspersky and F-Secure fail
Virus Bulletin's June 2007 comparative, run on Windows XP Service Pack 2, drew what the tester John Hawes called "a truly bumper crop, well outstripping previous records": the usual entrants joined by firewall and anti-spyware houses rolling virus detection into their own products, most licensing an established engine rather than writing one. Microsoft submitted its long-delayed corporate client, Forefront Client Security, for the first time, its release to market expected around the issue's publication; the product wanted a Windows 2003 server and a stack of components to install, kept no logs of its own and let one WildList sample past on access with the default action set to allow, yet qualified. F-Secure and Kaspersky each missed the same Allaple sample and failed, Kaspersky's detection having been present days either side of the test. On 18 June 2007 PatchLink agreed an all-stock merger, no price disclosed, with SecureWave of Luxembourg, whose product allowed only approved executables to run; the pair became Lumension Security that July, a name that lasted until 2015 before folding into what is now Ivanti.
⏳ Time capsule — June 2007
- On 14 June the United Progressive Alliance named Pratibha Patil its candidate for the presidency of India, in an election held the following month.
- On 22 June Atlantis came down at Edwards Air Force Base in California at 3:49 p.m. EDT, weather having closed the Kennedy Space Center, ending STS-117 and bringing home Sunita Williams after more than six months aboard the International Space Station — then the longest single spaceflight by a woman. Her nine spacewalks ran to 62 hours and 6 minutes, still the most time outside by any woman.
- On 27 June the Queen accepted Tony Blair's resignation and invited Gordon Brown to form a government. Blair stood down the same day as the member for Sedgefield and was named the Quartet's envoy to the Middle East.
- On 29 June the first iPhone went on sale in the United States at $499 for the 4 GB model and $599 for the 8 GB, both on a two-year contract. Apple reported 270,000 sold in the first thirty hours.
The Shape That Lasted
MPack itself ended without a courtroom. Nobody was charged over the Italian campaign, the kit was superseded, and the numbers attached to it — ten thousand sites, eighty thousand addresses, a claimed one in two — were never tested by anyone but their authors and the researchers counting from outside. What lasted was the shape of the thing: version numbers, tiered pricing, paid modules, an update subscription, a support line and a dashboard. By 2012 the Blackhole kit had carried the model further, Sophos attributing 29 per cent of the web threats it detected to it, and its author Dmitry Fedotov became the one exploit-kit proprietor to reach a court: arrested in Russia in October 2013 and sentenced in April 2016 to seven years in a penal colony.
The June injections settled a question of where to attack. Breaking into ten thousand hotels and car dealers one at a time was never the plan; the short route to their visitors ran through the company that hosted them all, and that calculation has opened most drive-by campaigns since. The Pentagon's unclassified mail has an ending of its own. On 23 June 2009, two years and two days after telling reporters he did not do email, Robert Gates directed the establishment of a Cyber Command; it reached initial operational capability on 21 May 2010, and the defence authorisation act signed on 23 December 2016 directed its elevation to a unified combatant command, a step that took effect on 4 May 2018. Nineteen years of reorganisation have not changed the way in: the door was email, and it still is.