The trail started with a favour. An acquaintance of Don Jackson, a researcher at the Atlanta managed security firm SecureWorks, found that accounts on sites he used from both work and home had been taken over, and the investigation traced the losses to a single unclassified executable that appeared to have been installed on his machine the previous December. Jackson found it in January 2007. None of the thirty anti-virus products he tested that month specifically detected it — several flagged it as suspicious or generic only because it had been packed with a common tool — and by early February, with updated signatures, five still missed it entirely. It had gone largely undetected for more than fifty days.
His analysis, published on 20 March 2007 and updated the next day, explained why the padlock in the address bar had not helped. The trojan installed itself as a Winsock2 layered service provider, sitting between Internet Explorer and the socket beneath it: "This is the mechanism used to bypass SSL/TLS and intercept the network data on the fly, before it is encrypted." A second module hooked the browser's JavaScript engine to catch the AJAX requests the first could not see. Default settings told it which pages were worth watching for forms. Victims had picked it up from hosted sites, community forums, social networking pages and small business sites, through a buffer overflow in Internet Explorer's handling of iframe tags.
What Jackson found at the other end was not a dropbox but a shop. The mothership sat on a Russian-owned business network, probably in St Petersburg. Stolen material arrived indexed; customers logged in to a web front end, queried it by fields such as URL and form parameter, and paid per query in WebMoney units the analysis equated to the dollar — about 100 for three passwords from a small retailer, 2,500 or more for ten from an international bank. The kit behind it was offered in chat for $2,000; comparable kits, the analysis said, started between $1,000 and $2,000. "A single attack by a single variant compromises more than 5200 hosts and 10,000 user accounts on hundreds of sites," Jackson wrote, putting the haul's black-market value at $2 million or more — his estimate, not a price paid.
Computerworld, reporting the analysis the same day, added what was in the records: roughly 2,000 Social Security numbers, account numbers and credentials for banking, retail and e-commerce sites, employee logins for applications at more than 300 companies and government organisations including several federal and state law-enforcement agencies, and medical information belonging to health care staff and patients. Jackson said the subscription service was switched off on 12 March; the server stayed up and went on collecting. The month's famous figure came from elsewhere — TJX's annual report, filed on 28 March, put the card numbers taken from its systems at about 45.7 million, finally quantifying the January disclosure — but Gozi was the shape of the thing to come.
Thirty-one Days of PHP
Stefan Esser had resigned from the PHP Security Response Team in December 2006. Interviewed by Federico Biancuzzi in a piece published in early February 2007, he set out his complaints: fixes committed to public CVS "so that everyone can see them", releases that took weeks or months, no security-only updates, fixed bugs shipped without test cases. Core developers, he said, had called him an "immoral traitor" for disclosing PHP holes publicly. The point of March, he explained, was to make people — PHP's own developers above all — aware that bugs existed in the interpreter's code, not only in the applications written on it; only the default distribution was in scope. Eleven flaws appeared in the first five days; he set himself no ceiling: "we do not enforce a one-vulnerability-per-day limit upon ourselves." Forty-four advisories came out in all, of which Esser counted forty-one as flaws in PHP itself. Critics in the PHP community called the exercise revenge; Esser said afterwards that he felt vindicated. The fixes arrived in PHP 5.2.2 and 4.4.7 in early May, and an OpenPKG advisory of 25 May still listed fourteen of the March flaws as affecting PHP 5.2.2 and earlier.
Votes Cast From Home
Estonia went to the polls for parliament on 4 March 2007, and 30,275 of its citizens — about 5.4 per cent of the votes cast, or one in thirty of those on the register — had already cast their ballots over the internet during the advance window from 26 to 28 February. It stands on the record as the world's first national general election with internet voting; the country had tried the method in the 2005 local elections, where 9,317 people, 1.9 per cent, voted online. The machinery was the mandatory national identity card, a smart card that authenticated the voter remotely and carried a legally binding digital signature. Votes travelled encrypted, were decrypted with the electoral commission's key and stripped of their signatures before counting, and a voter could replace an electronic vote as many times as he wished, only the last one counting, or cancel it altogether by turning up at a polling station during advance voting. Seven weeks later the same country's networks came under sustained attack (May 2007).
Nine Million by 2007
The Broadband Policy of 2004 had put numbers against the year ending 2007: 18 million internet subscribers and 9 million broadband connections, broadband defined as an always-on link of at least 256 kbps downstream. At the end of March 2007, on the regulator TRAI's count, the country had about 9.3 million internet subscribers and 2.34 million broadband lines — about half the first target and about a quarter of the second. The government had named 2007 the Year of Broadband regardless, and in New Delhi that month Convergence India filled five halls of the Pragati Maidan showgrounds with wireless equipment: WiMax above all, alongside 3G and 802.11 mesh, a base station bolted to a jeep outside one entrance and a vendor's demonstration housed in a tuk-tuk. BSNL was selling DSL at 250 rupees a month, about $5.74; MTNL was promoting IPTV ahead of an April launch.
The gap decided something that mattered more than the targets: where Indians got online. Not at home, on a line billed to a named subscriber, but on shared machines — and the rules that grew up around shared machines were about identity at the counter rather than security at the endpoint. Kerala's cyber café regulations, notified on 23 June 2007, required a photographic identity document before access, a log register kept for a year, computer clocks synchronised to Indian Standard Time, screens facing the common area and partitions no higher than two and a half feet above the monitor; Rajasthan framed its own rules the same year, and national ones followed in 2011. Nineteen years on the obligations fall on the organisation rather than the café, as our India desk sets out.
Microsoft buys Tellme, Metaweb opens Freebase
Microsoft said on 14 March 2007 that it would buy Tellme Networks, a privately held Mountain View company of more than 320 people whose voice services answered millions of telephone calls a day — business listings, directions, weather, share prices — and whose platform, on Tellme's own figures, carried billions of calls for hundreds of services used by more than 40 million people a month. Terms were not disclosed; Steve Ballmer presented speech as a universal and simple interface for computing, a claim that came good on handsets rather than on phone lines, and Microsoft sold the hosted voice-response business on in 2012. Earlier the same month Metaweb opened Freebase, which it called "an open shared database of the world's knowledge" — collaboratively edited, cross-linked, holding facts rather than documents. Google bought Metaweb in July 2010, used the data to seed its Knowledge Graph, and closed Freebase in 2016, passing what it held to Wikidata. In Seoul the Commerce, Industry and Energy Ministry said a taskforce was drafting a robot ethics charter, to be finished that year.
McAfee names a new chief from EMC
McAfee had been running on an interim chief executive since October 2006, when its chief executive resigned and its president was dismissed amid an SEC investigation into backdated share options; an arbitrator cleared two of the departed executives in 2009. On 5 March 2007 the board named a permanent successor, Dave DeWalt, until then president of customer operations at EMC, to take the chief executive's chair on 2 April, the interim incumbent standing down the day before and staying on as a director. DeWalt ran the company until 2011, by which time Intel had bought it. A quieter document that month showed how little a pass mark measured: AV-Comparatives tested CA Antivirus 2007 on its own, at the request of users and with the agreement of some CA staff, and put its total on-demand detection at 65 per cent, which "would in our tests not reach any certification level" — though the product carried ICSA Labs and Check-Mark certificates. Vendors and labs founded a testing-standards body, AMTSO, the next year.
⏳ Time capsule — March 2007
- On 11 March daylight saving time began in the United States three weeks earlier than it used to, the Energy Policy Act of 2005 having moved the spring change from the first Sunday in April to the second Sunday in March and pushed the autumn change back to 4 November.
- The ninth Cricket World Cup opened with a ceremony at Trelawny Stadium in Jamaica on 11 March and ran from 13 March to 28 April. Herschelle Gibbs hit six sixes in an over on 16 March, the first man to do it in a one-day international; Bangladesh beat India by five wickets on 17 March; India beat Bermuda by 257 runs on 19 March, then the largest margin in one-day international history, and still finished third in Group B and went out at the group stage.
- On 22 March NBC Universal and News Corporation announced an advertising-supported online video network to compete with YouTube, with AOL, MSN, MySpace and Yahoo! signed up to distribute it; the venture became Hulu.
- On 23 March the PlayStation 3 reached Europe, Australia and the other PAL territories at €599; Chart-Track put United Kingdom sales at 165,000 over the opening weekend, and Sony said about £100 million changed hands there in the first two days, before sales fell away sharply in the following weeks.
What the Shop Sold
The case surfaced nearly six years later. On 23 January 2013 federal prosecutors in Manhattan announced charges against three men — a Russian accused of creating Gozi, a Latvian resident accused of writing the injects that rewrote bank pages inside victims' browsers, and a Romanian accused of running the bulletproof hosting the operation relied on (January 2013). The papers named the rental business 76 Service: for a weekly fee, prosecutors said, customers were given the virus, allowed to configure what it stole, and had the stolen data stored for them. Prosecutors called Gozi "one of the most financially destructive computer viruses in history" and put infections above a million machines, at least 40,000 of them in the United States.
All three were convicted. The Russian had been arrested in the United States in November 2010 and pleaded guilty in May 2011; he was sentenced on 2 May 2016 to the thirty-seven months he had already served, and ordered to pay close to $7 million. The Latvian's twenty-one months matched time served; the Romanian pleaded guilty in February 2023 and was sentenced on 12 June 2023 to three years, forfeiting $3.51 million. The code outlasted the prosecutions: researchers at F5 were still dissecting Gozi campaigns against banks in Canada, France and the United States in January 2019, built on malicious code injected into the pages of each targeted institution. PHP absorbed its month and kept the argument. Estonia kept voting from home: 51.1 per cent of votes in its 2023 parliamentary election were cast online, the first time more than half, and observers still report the count is not end-to-end verifiable.