On Tuesday 22 April 2008 the security firm Websense published details of web pages that had begun to carry a script tag calling a file named 1.js from nihaorr1.com, a domain whose registration records, The Register found, appeared to point to someone in Shanghai. By Thursday The Register was reporting that the United Nations and Britain's Civil Service were among those hacked. A visitor's browser obeyed the tag without complaint: the script loaded a frame from a malware server, which passed the browser to a kit that tried eight exploits against Windows programs, AIM, RealPlayer and iTunes among them, every one already patched. Where one worked, the program it installed watched for passwords and sent them back to its controller, the SANS Internet Storm Center reported.
Nobody had typed the line into those pages. In January, when an earlier wave sent visitors to uc8010.com and reached CA's press pages among others, a Storm Center handler, Bojan Zdrnja, had decoded the method: a request to an ASP page carried commands disguised as a long hexadecimal string, which SQL Server was told to decode and run. The commands read the database's own list of tables, then looped through every text column of every user table, appending a script tag to whatever it held; every page built from those fields served it. Almost all the victims, he noted, ran IIS and SQL Server. On 16 April he described the tool behind the January wave, found by the researcher Neal Krawetz, which chose targets by searching Google for ASP pages.
How many pages carried the line depended on who was searching, and every figure was an estimate. A Yahoo search for "nihaorr1" returned 173,000 results for The Register; the Storm Center's own search returned 226,000, with a caution that many sites had been hit more than once. On 25 April Computerworld gathered the rest: Websense's Dan Hubbard put the hacked sites in the low six figures, Panda Security said 282,000, and F-Secure counted more than half a million infected pages. Panda's Ryan Sherstobitoff said Panda had reported an IIS security issue to Microsoft, unsure whether it was a vulnerability. "You used to know that if you walked down the dark streets of the Web, you would be infected," he said. "Today, you really can't tell what the dark streets are."
Microsoft first said it had not determined whether the reports were related to its advisory of 17 April on a Windows flaw. On Friday 25 April Bill Sisk of its security response centre wrote that its investigation had shown "there are no new or unknown vulnerabilities being exploited". The holes were in web applications that passed visitors' input into database commands. In mid-May SecureWorks found Asprox, a phishing botnet, installing a SQL injection tool of its own; The Register judged it most likely the work of people in Eastern Europe, unlike the earlier, apparently Chinese, injections. On 24 June Microsoft pointed administrators to three tools to find vulnerable pages and filter attacks. In 2009 US-CERT recorded attacks "that affected more than half a million websites": an estimate of pages had become a count of sites.
Kraken or Bobax
On Monday 7 April 2008 Damballa, an Atlanta security start-up, announced Kraken, a botnet it said had been seen at 409,912 unique internet addresses in a single day, 25 March: more than twice the size of Storm, with machines in at least 50 Fortune 500 companies. "Kraken, despite being on all these people's computers, has such low anti-virus coverage," said Paul Royal, its principal researcher. The same day an Internet Storm Center handler wrote that it looked like part of the Bobax family, and Joe Stewart of SecureWorks, in a survey of spam botnets published that week, listed Kraken simply as another name for Bobax, an older botnet he ranked the second-largest spam botnet, at about 185,000 bots. Kraken's bots computed the names of their servers. At the end of the month TippingPoint's Pedram Amini and Cody Pierce, having taken the malware apart, set up a command server of their own and counted about 25,000 machines calling in over a week, and they had the means to remove Kraken from them through its own update mechanism. Their boss, David Endler, decided against it: a removal, he worried, might crash a machine someone depended on, and the liability would be TippingPoint's.
A Flood Called Off
On Thursday 17 April 2008 attack traffic reached CNN.com, and the network said its site had been slow or unavailable "to some users in limited areas of Asia". Chinese hackers objecting to CNN's coverage of Tibet had called for a larger flood on Saturday 19 April, and a group calling itself Revenge of the Flame was organising it. What arrived was small. Danny McPherson, chief research officer of Arbor Networks, said www3.cnn.com had taken a minor flood that lasted about 21 minutes. Then the group called off its main attack, promising another later: "Our original plan for 19 April has been canceled because too many people are aware of it and the situation is chaotic."
Twenty-One Cards
On Tuesday 1 April 2008 the Delhi Police began training officers to investigate crime committed through computers. A hundred were to be trained in the following months; the first fifty, five assistant commissioners, fifteen inspectors and thirty sub-inspectors, started a course of a month and a half in e-mail tracking, digital fraud and credit-card fraud at Guru Gobind Singh Indraprastha University. Cyber crime cases in the capital had risen by 200 per cent in 2007, The Hindu reported, and credit-card fraud cases by 500 per cent. Two days later The Tribune reported a case in point: police at Saraswati Vihar had arrested five men and recovered 21 cards made to resemble ordinary Indian credit cards, whose magnetic stripes, when swiped, revealed the accounts of people in the United Kingdom. The gang's frauds came to about ₹30 lakh.
The law the officers would apply, the Information Technology Act of 2000, had been written to give "legal recognition" to electronic commerce; offences such as identity theft and cheating by computer arrived only with the amendment passed in December. The telecom department was meanwhile holding up Tata Teleservices' BlackBerry launch until the security agencies could monitor the service, as July 2008 records. Complaints like these found a national channel only in January 2020, when the Home Minister, Amit Shah, inaugurated the Indian Cyber Crime Coordination Centre in New Delhi and dedicated a national cyber crime reporting portal; its helpline, 1930, is the number this magazine gives anyone caught in a "digital arrest".
Microsoft buys a fare predictor
On 17 April 2008 Farecast's chief executive, Hugh Crean, confirmed that Microsoft had bought the Seattle company; the Seattle Post-Intelligencer, which broke the story, put the price at $115 million, and Microsoft did not confirm it. Farecast had been founded in 2003 by Oren Etzioni of the University of Washington, and its models, built from millions of flight observations gathered daily, told a traveller whether a fare was likely to rise or fall. Microsoft folded it into Live Search, renamed it Bing Travel in June 2009 and dropped the prediction itself in January 2014; Etzioni became founding chief executive of the Allen Institute for Artificial Intelligence. Microsoft also completed its purchase of the Oslo enterprise search firm FAST Search & Transfer on 24 April. On 8 April Nuance Communications had agreed to pay about $363 million for eScription, whose software let medical transcriptionists edit a machine's draft instead of typing from nothing, an arrangement Nuance said would save the healthcare industry "more than $1 billion by 2011"; Microsoft bought Nuance itself in 2022, for $19.7 billion.
Stirling promises a single console
At the RSA Conference on 8 April 2008 Microsoft released the public beta of its next-generation Forefront security system, code-named Stirling, which put client, server and network-edge protection under a single console: Forefront Client Security, the Exchange and SharePoint products and the Threat Management Gateway, tied by a mechanism it called Dynamic Response that shared threat information between them and acted on it. Ryan Hamlin, general manager of its access and security division, said customers were finding IT security "increasingly complex, with multiple point solutions and management consoles". Release was promised for the first half of 2009; the Forefront line was eventually discontinued, its endpoint product becoming System Center Endpoint Protection. The same day Symantec published volume XIII of its Internet Security Threat Report, whose underground-market table priced bank account credentials highest and credit card details from forty cents. On 10 April Symantec said it would buy AppStream of Palo Alto, whose software streamed virtualised applications to endpoints; the deal closed on 18 April, and a later quarterly filing put the price at $53 million.
⏳ Time capsule — April 2008
- On 8 April Yi So-yeon lifted off from Baikonur aboard Soyuz TMA-12 with Sergey Volkov and Oleg Kononenko and became the first South Korean in space. She came home on 19 April aboard Soyuz TMA-11 with Peggy Whitson and Yuri Malenchenko, in a ballistic re-entry that put the crew through forces of up to ten times Earth's gravity and landed some 420 kilometres off target in Kazakhstan.
- On 18 April the Indian Premier League opened at the M. Chinnaswamy Stadium in Bangalore, and Brendon McCullum made 158 not out from 73 balls for Kolkata Knight Riders, who beat Royal Challengers Bangalore by 140 runs.
- On 28 April PSLV-C9 lifted off from the second launch pad at the Satish Dhawan Space Centre and placed ten satellites in a sun-synchronous orbit about 637 kilometres up: Cartosat-2A, IMS-1 and eight nanosatellites from abroad, the most a single PSLV had yet carried.
- On 29 April Rockstar Games released Grand Theft Auto IV for the PlayStation 3 and Xbox 360, set in Liberty City, its version of New York. It sold more than 3.6 million copies in its first twenty-four hours, and on 13 May Guinness World Records named it the fastest-selling video game over that span.
Still in the Query
SQL injection outlived every wave of 2008. Albert Gonzalez's indictment said Heartland's network had been entered that way, as August 2009 records; the technique reached RockYou's 32 million passwords in December 2009, and the web server from which intruders went on to take Bit9's signing certificate, disclosed in February 2013. On 27 May 2023 Cl0p began exploiting a SQL injection flaw in MOVEit Transfer, the campaign June 2023 tells, and on 25 March 2024 CISA and the FBI asked software makers to eliminate the class altogether, recalling that it had been considered an "unforgivable" vulnerability since at least 2007. The cure had been on US-CERT's list since 2009: prepared statements, which keep a visitor's input out of the command itself.
Estimates of Kraken's size ran from SecureWorks's 185,000 to Damballa's more than 400,000. Its computed names left a plainer lesson: a bot that works out where to find its masters can be met there by whoever registers the name first, and Srizbi's fallback names in November 2008 and Conficker's 250 a day in February 2009 made that race a fixture of botnet defence. TippingPoint's restraint had its answer in January 2021, when police in eight countries pushed an uninstaller to Emotet's machines through the botnet's own update channel. The floods aimed at CNN were small beside the botnet of cameras and video recorders that took down Dyn in October 2016. BT's admission in April 2008 that it had tested Phorm's advertising system on customers without telling them is told in April 2009.