From the early hours of Saturday 19 July 2008, Georgian time, the website of President Mikheil Saakashvili was flooded for more than a day. The Shadowserver Foundation, a volunteer group that tracks malicious network activity, watched at least one botnet throw TCP, ICMP and HTTP floods at president.gov.ge at once. Its command server was a MachBot controller, a tool Shadowserver said Russian bot herders often used, on a domain whose seemingly bogus registration tied back to Russia; the machine itself, the group told The New York Times, sat in the United States and had come online several weeks before the assault. Jose Nazario of Arbor Networks found a message in the stream of data: "win+love+in+Rusia".
The war between Russia and Georgia over South Ossetia began in the night of 7–8 August and ended with a ceasefire agreed on 12 August; it killed hundreds of people and drove many thousands from their homes. The attacks on Georgia's networks resumed with the fighting: a researcher who tracked the Russian Business Network reported Georgian servers under outside control from late on 7 August, and by Sunday 10 August Shadowserver was watching HTTP floods hit the sites of the president and parliament. The foreign and defence ministries' sites went down, and the news site Civil.ge was flooded too. Media, communications and transport companies were attacked, and the National Bank of Georgia's site was defaced at one point. The New York Times, quoting technical experts, called it the first time a known cyberattack had coincided with a shooting war.
Georgia's sites went looking for shelter. The president's moved to Tulip Systems, a hosting company in Atlanta that volunteered its servers; its acting chief executive, Tom Burling, said later that some of the attacking botnets were firing from Comcast addresses in the United States. The foreign ministry, its own site down, published its statements on Google's Blogger, and Civil.ge did the same. Estonia, flooded itself the year before, hosted the foreign ministry's site, and Poland's president, Lech Kaczyński, offered his own website to carry Georgia's news. Pictures setting Saakashvili beside Adolf Hitler were put up on the president's site and on parliament's. Georgia was not the only target: a command server Shadowserver watched also aimed floods at a Russian site, and Jose Nazario saw Georgia apparently hitting back at a Moscow newspaper's site.
Blame came faster than evidence. Georgia's foreign ministry blamed "a cyber warfare campaign by Russia". Don Jackson of SecureWorks traced part of the assault to servers controlled by the Russian Business Network, the St Petersburg outfit linked to malware and identity theft, and found other attacking machines using "Internet addresses belonging to state-owned telecommunications companies in Russia". Russia denied involvement; a Kremlin spokesman answered that it was Russian media and organisations that were being attacked. Volunteers, some recruited through a forum, StopGeorgia.ru, were handed target lists and simple flooding tools. A year later the US Cyber Consequences Unit concluded that civilians had carried out the attacks, with little or no direct involvement by the Russian government or military, though the organisers had advance notice of Russian military intentions.
Forty Million Numbers
On Tuesday 5 August 2008 a federal grand jury in Boston indicted Albert Gonzalez of Miami, and charges against ten others — from Miami, Ukraine, Estonia, Belarus and China, and one known only as "Delpiero" — were filed or unsealed in Boston and San Diego. The haul, prosecutors said, was more than 40 million credit and debit card numbers, from TJX, BJ's Wholesale Club, OfficeMax, Barnes & Noble, Sports Authority and others. The method was unglamorous: "wardriving" for the retailers' wireless networks, then sniffer programs that caught card numbers, passwords and account details as they moved through the payment networks, kept on encrypted servers in Eastern Europe and the United States. Blank cards encoded with the numbers drew tens of thousands of dollars at a time from cash machines. The department believed it the largest hacking and identity theft case it had ever prosecuted. Gonzalez, arrested by the Secret Service in 2003, was its confidential informant when it found him in the scheme. Charged over Heartland a year later (August 2009), he pleaded guilty to the TJX charges that September and was sentenced to twenty years in March 2010 (July 2013).
Ten Days of Silence
On Friday 8 August 2008 the Massachusetts Bay Transportation Authority sued three MIT undergraduates, and MIT, in federal court in Boston. That Sunday, at DEF CON in Las Vegas, the students were to give "The Anatomy of a Subway Hack", on the CharlieTicket, whose magnetic stripe could be reprogrammed, they would show, to hold $655.36 with a $200 stripe writer, and on the CharlieCard, built on the MIFARE Classic chip of July's Dutch court case. On Saturday Judge Douglas Woodlock ordered them, for ten days, not to provide any "program, information, software code, or command" that would help anyone attack the fare system; the MBTA's claim rested on the Computer Fraud and Abuse Act. The talk was not given, though its slides had already been distributed to the conference's attendees. The students had met MBTA officials on 4 August and delivered a confidential vulnerability report on the day it sued, and the MBTA told the court it would need five months to fix the flaws. On 19 August Judge George O'Toole refused to renew the order. On 22 December the suit was dismissed, and the two sides agreed to work together on the system's security.
Cleared Before Connected
On 18 August 2008 the Telecom Regulatory Authority of India recommended lifting the rule that had penned in internet telephony since it was first allowed, on 1 April 2002: an internet provider could connect calls between computers, and to telephones abroad, but not to a landline or mobile in India. TRAI had opened the question itself on 12 May. It proposed letting providers connect calls to and from Indian phones through long-distance operators, with numbers from blocks set aside for the purpose. The licensed telephone operators, already allowed to offer the service, had not; the preface, signed by the chairman, Nripendra Misra, saw "complete market failure", with grey markets filling the gap. India, with about 11 million internet subscribers, already carried most of its international calls over IP networks.
The condition was interception. Every provider would install lawful interception equipment meeting the security agencies' requirements and cleared by them before service began; until then the telecom department was to allocate no numbers. The internet, the report warned, could carry stronger encryption than licences permitted, "posing serious threat for decoding of the message". The ISP licence let users encrypt with symmetric keys of up to 40 bits without permission; anything stronger needed written permission and the decryption key deposited with the licensor, "split into two parts". For internet providers the opening did not come. A year on they still could not reach an ordinary number, and the Intelligence Bureau wanted internet calls blocked altogether (September 2009). The licensed operators' version, TRAI wrote in 2018, "did not take off"; on 19 June that year the department declared it "un-tethered from the underlying access network", usable over anyone's connection.
MoGo beats a professional on nine stones
On 7 August 2008, at the US Go Congress in Portland, Oregon, MoGo, a program from France's INRIA, beat Kim Myungwan, an 8-dan professional, by 1.5 points on the full board after taking nine handicap stones, the customary maximum. It ran on 800 processor cores of Huygens, a Dutch supercomputer, and the ICGA Journal reported the first win by a program at that handicap against a professional of his standing. MoGo played by Monte Carlo tree search, proposed in 2006: rather than judging positions by hand-written rules, it played out vast numbers of quick, partly random games and favoured the moves that won most often. Kim rated it an amateur of "two or maybe three dan". On 20 August Microsoft's Live Labs opened Photosynth to the public: it compared 20 to 300 overlapping photographs for shared features, estimated where each had been taken and rebuilt the scene in navigable 3-D. Demand forced the site into read-only mode within hours. Photosynth closed on 6 February 2017; by then AlphaGo had beaten professionals without a single stone.
Symantec agrees to buy Spyware Doctor's maker
On 18 August 2008 Symantec agreed to buy PC Tools, a privately held Sydney company that made Spyware Doctor and utilities such as Registry Mechanic. The terms were not disclosed; PC Tools was to keep its brand and its chief executive, Simon Clausen, and run separately inside Symantec's consumer division. Late in August a NASA spokesman confirmed that anti-virus software had caught a worm aboard the International Space Station on 25 July, though he would not name it; SpaceRef had identified it as W32.Gammima.AG, Symantec's name for a year-old worm that stole online gamers' passwords. It had never threatened any command-and-control computer, he said, and there had been other incidents; NASA was loading the station's A31p laptops with the latest Norton AntiVirus. The PC Tools deal closed on 6 October, and Symantec's next quarterly filing put the price at about $250 million in cash, with up to $30 million more if PC Tools met bookings and expense targets within six months. Symantec withdrew PC Tools' security products in May 2013 and retired the brand that December.
⏳ Time capsule — August 2008
- On 1 August a total solar eclipse crossed northern Canada, Greenland, central Russia, eastern Kazakhstan, western Mongolia and China. Totality lasted longest, 2 minutes 27 seconds, near Nadym in Russia, and a partial eclipse was visible across most of Europe and Asia.
- On 8 August, from 8 p.m., the Beijing Olympics opened in the National Stadium, the Bird's Nest, with a ceremony directed by the film-maker Zhang Yimou: 15,000 performers before a full house of 91,000, by the organisers' count. The gymnast Li Ning, suspended on wires, seemed to run along the stadium's walls before lighting the cauldron; most of the giant firework footprints seen on television had been made by computer.
- On 11 August Abhinav Bindra won the 10 metre air rifle with 700.5 points, India's first individual Olympic gold. Level with Henri Häkkinen before the last shot of the final, he scored 10.8 to Häkkinen's 9.7. Sushil Kumar's wrestling bronze followed on 20 August, and India's first Olympic boxing medal, Vijender Singh's middleweight bronze, on 22 August.
- On 17 August Michael Phelps swam the butterfly leg as the United States won the 4×100 metre medley relay in a world record 3 minutes 29.34 seconds. It was his eighth gold medal of the Games, one more than the seven Mark Spitz had won in 1972.
A pattern, then a name
Proof never caught up with suspicion. In October 2008 a volunteer inquiry, Project Grey Goose, published its first report on the attacks; in its follow-up of March 2009, researchers at Greylogic judged a "strong likelihood" of planning and direction by Russia's GRU and FSB through intermediaries, a circumstantial case the US-CCU did not make. The method recurred. A flood SecureWorks likened to Georgia's choked Kyrgyzstan's providers in January 2009, and one aimed at a single Georgian blogger took Twitter off the air in August 2009. When thousands of Georgian websites were defaced in October 2019, Britain and the United States named the attacker in February 2020: the GRU's Sandworm. And as the invasion of Ukraine opened in February 2022, tens of thousands of satellite modems went dark across Europe.
Refuge became a service. In 2008 Georgia's sites had to find hosts abroad willing to take the flood; when Brian Krebs's site lost Akamai's protection to a flood in September 2016, it came back under Project Shield, Google's free protection for journalists. The Boston order left the longer argument. Judge O'Toole had ruled on the narrowest ground, the anti-hacking law's wording about transmitting code to protected computers, and left free speech alone; the Supreme Court narrowed the same Computer Fraud and Abuse Act in Van Buren v. United States on 3 June 2021, and on 19 May 2022 the Justice Department made it policy not to charge good-faith security research under it, a road this archive follows in June 2010 and January 2013.