Lawyers for the banks suing The TJX Companies filed documents in the United States District Court in Boston on Tuesday 23 October 2007 stating that the intrusion into the retailer's systems had reached more than 94 million separate accounts over seventeen months. The figures were not the plaintiffs' own arithmetic. They came, the banks said, from depositions by officials of Visa and MasterCard that had been confidential until then, and broke down to about 65 million Visa accounts and 29 million MasterCard. The filing put fraud losses on the Visa accounts alone at between $68 million and $83 million — $1.04 to $1.28 a card — and accused the retailer of minimising what had happened: "Faced with overwhelming exposure to losses it created, TJX continues to downplay the seriousness of the situation." TJX had disclosed at least 45.7 million card numbers seven months earlier.
The company did not accept the larger number. It did not return calls seeking comment on the filing, and in the litigation itself it was arguing that the banks did not qualify as a class at all. TJX had said in March that about three-quarters of the compromised cards were expired or had masked magnetic-stripe data, and it did not move off its own figure. Canada's privacy commissioner, reporting a month before the filing, had faulted the company for collecting more data than it needed and for leaving the wireless networks in its shops on WEP. The dates mattered as much as the count: the plaintiffs placed the start of the intrusion in July 2005, TJX found the compromise in mid-December 2006, announced it on 17 January 2007, and arrived at 45.7 million by the end of March.
How it had begun was already public, if never confirmed by the company. The Wall Street Journal reported in May 2007, citing investigators, that the trail led to the car park of a Marshalls store in St Paul, Minnesota, where a laptop and a telescope-shaped antenna had been used to read traffic passing between the shop's scanners, registers and computers over a wireless network running WEP. Meanwhile the settlement with shoppers was in difficulty. At a hearing on 27 September Judge William G. Young said he was "very troubled by the vouchers, even if they are legal", and TJX's lawyer, Harvey J. Wolkoff, replied that the $30 vouchers were fully transferable and could be resold on eBay. "Too hard for me, Mr. Wolkoff," the judge answered. "Too hard for me." Sending shoppers off to negotiate on eBay, he made clear, would not cut it.
The revision TJX filed on 9 October let claimants choose the $30 voucher or a $15 cheque, capped the cash at $7 million, and cut a promised three-day national sale to one day with longer hours. The banks never got their class: on 12 October the court threw out most of their claims and refused to certify what was left. In December every named bank plaintiff but one settled, and the Massachusetts, Connecticut and Maine bank trade groups behind the case told their members to take the Visa offer TJX had announced on 30 November — up to $40.9 million, conditional on acceptance by banks holding 80 per cent of the affected accounts, which issuers of more than 95 per cent went on to give. A $24 million MasterCard settlement followed on 2 April 2008, accepted by issuers of 99.5 per cent of the claimed accounts. The criminal charges over the intrusion came in August 2008.
A Key Without a Network
Two researchers at AirTight Networks, Vivek Ramachandran and Md Sohail Ahmad, came at WEP from the other end, at Toorcon in San Diego from 19 to 21 October 2007. Earlier attacks on WEP had assumed a network: the attacker sat in range of an access point and gathered enough traffic to recover the key. The Caffe Latte attack ignored the access point and went for the client. Using what Ramachandran called "various behavioral characteristics of the Windows wireless stack" along with WEP's known flaws, it made a laptop hunting for a network it had used before emit thousands of WEP-encrypted ARP requests, and read the key out of them in anything from minutes to a couple of hours. The talk, the pair said, debunked "the age-old myth that to crack WEP, the attacker needs to be in the RF (radio) vicinity". InfoWorld put the share of businesses still running WEP at 41 per cent, much of it in tills and warehouse kit that supported nothing else. A year later the card industry's standard set dates: no new WEP after 31 March 2009, none in card processing after 30 June 2010.
Bulletproof in St Petersburg
On 13 October 2007 the Washington Post published Brian Krebs's account of the Russian Business Network, a St Petersburg operation that sold criminals hosting and kept their sites up. It was not a registered company, its domains were registered anonymously and its operators went by nicknames. Buyers reached them by instant message or in Russian-language forums, where, Don Jackson of SecureWorks said, a customer had to prove he was no investigator by showing active involvement in stealing data. VeriSign put a dedicated site at $600 a month, ten times the going rate, and traced $150 million taken from bank accounts the year before to one group working through the network. Security researchers put about half the previous year's phishing at groups using its computers. Symantec called it "literally a shelter for all illegal activities". Alexander Gostev of Kaspersky Lab named the obstacle: "From a legal point of view, they are clean" — and Russian authorities, the Post reported, had given investigators little help. Nine days later a representative, Tim Jaret, told Wired's Threat Level that most of the abuse complaints against the network lacked "any ground or proves of violation" of its acceptable use policy or of Russian law. By early November its address ranges had stopped routing altogether.
India's Own Convention
A notice went round the security mailing lists on 8 October 2007 with a deadline a week later. ClubHack — a group describing itself as security professionals, hackers, cyber lawyers, administrators and law-enforcement people — was calling for papers for ClubHack2007, offered as the answer to something it said the Indian hacking community had felt the need of for years: a convention on the lines of Black Hat and DEF CON. The event promised knowledge sharing, question sessions with experts and live demonstrations of recent attacks, exploits and countermeasures, for an audience the notice listed as chief information officers, chief technology officers, IT managers, system administrators, coders, researchers and cryptanalysts. Entry cost nothing and was by invitation only; the invitation kit came from the group's own website.
Read nineteen years later, the notice is striking less for what it promised than for what it assumed: that the expertise was already in the country and only needed somewhere to meet. The convention went ahead and became an annual December fixture in Pune, and the pattern it set — practitioners convening themselves, free, before any regulator asked them to — ran on through the community groups and conferences that followed. India's security practitioners organised themselves a long way ahead of the reporting duties they now work under, which our India desk sets out.
Hinton argues for layers, not labels
The October issue of Trends in Cognitive Sciences carried a review by Geoffrey Hinton of the University of Toronto, Learning multiple layers of representation. Backpropagation, it argued, had been the first efficient way to learn several layers of representation, but it needed labelled data and, in Hinton's words, "it did not work well in deep networks"; the remedy was networks with top-down connections, trained to generate sensory data rather than classify it, their features learned one layer at a time. Three layers of detectors trained on unlabelled handwritten digits read badly written ones the network had never seen. The layer-at-a-time method was superseded within a few years; the case for depth was not. The hardware followed: on 8 October 2007 Google and IBM opened a cluster of Linux blades running Xen and Hadoop, headed for more than 1,600 processors, to six universities, for students to write parallel programs against. On 19 October 2007 Radar Networks unveiled Twine, which parsed users' text into RDF triples against a Wikipedia-derived taxonomy — the hand-built route to machine meaning, closed in 2010.
McAfee buys its way into encryption
McAfee announced on 8 October 2007 that it had agreed to buy SafeBoot B.V. for $350 million in cash — not a scanning engine but encryption, of individual files and folders and of the whole local hard drive, sold to more than 4,200 corporate customers including more than 150 of the Fortune 500. Dave DeWalt, the chief executive, said the products met "a critical pain point for customers"; they were to be folded into ePolicy Orchestrator beside McAfee's data-loss tools as a new Data Protection unit, and the deal closed on 19 November 2007. It was the pattern of the month. Websense completed its purchase of SurfControl, the British web and email filtering firm, on 3 October 2007 for about £204 million; Trend Micro bought Provilla, a data-loss prevention developer; and on 30 October 2007 McAfee agreed to pay $51 million for ScanAlert, whose Hacker Safe seals rated websites rather than desktops. The industry spent October buying everything except anti-virus — the shape the endpoint product has kept ever since, the scanner one component among several.
⏳ Time capsule — October 2007
- On 10 October Radiohead released In Rainbows as a download from the band's own site at whatever price the buyer chose, including nothing. comScore reported in November that downloaders paid an average of $2.26 and that 62 per cent paid nothing — a finding the band called "wholly inaccurate". The download closed on 10 December; a boxed edition shipped that month.
- On 12 October the Nobel Peace Prize was awarded to the Intergovernmental Panel on Climate Change and to Al Gore.
- On 17 October the Sensex fell 1,744 points, about 9 per cent, within a minute of opening, after the Securities and Exchange Board of India proposed curbs on participatory notes. Trading was suspended for an hour; the index reopened at 10:55 and closed down 336.04 at 18,715.82. It touched 20,000 intraday on 29 October.
- On 23 October at 15:38 UTC Discovery left the Kennedy Space Center on STS-120, carrying the Harmony module to the International Space Station. Pamela Melroy commanded the shuttle and Peggy Whitson the station — the first time two women commanded spacecraft at the same time. A tear in a solar array found on 30 October was stitched on 3 November with improvised cufflink straps.
What the Count Was Worth
Neither number was ever tested. TJX never accepted 94 million, the banks never got their class, and the dispute resolved in money rather than findings: up to $40.9 million to Visa issuers from the November 2007 offer, $24 million to MasterCard's in April 2008, $9.75 million to forty-one state attorneys general in June 2009, and a Federal Trade Commission order of 27 March 2008 that carried no fine but required an outside assessment of the company's security every two years for twenty years — a schedule with about two years left to run. What survived the argument was the method: card data read where it moved rather than taken from where it was stored, which is the shape of January 2009, of November 2013 and of September 2014.
The month's two briefs ended more cleanly, in opposite directions. WEP went. The Caffe Latte attack removed its last defence — that a thief had to be near the shop — and a year later the card industry gave it a date of death. Bulletproof hosting did not go; it moved. The Russian Business Network's addresses stopped routing in November 2007, comparable operations were soon offering the same shelter from other jurisdictions, and the same lesson had to be taught again in November 2008, and by sanction and seizure in most years since. Of everything in the month, the October call for papers has aged best: a convention asking for papers, free and by invitation, from a community that would spend the next two decades being asked for answers.