At a quarter past three on Tuesday 30 December 2008, the last afternoon of the 25th Chaos Communication Congress, seven researchers presented, in Saal 1 of the Berliner Congress Center, a certificate authority that no certificate authority had made. They were Alexander Sotirov, an independent researcher in New York; Marc Stevens of CWI in Amsterdam; Jacob Appelbaum of Noisebridge and the Tor Project; Arjen Lenstra and Dag Arne Osvik of EPFL in Lausanne; David Molnar of the University of California, Berkeley; and Benne de Weger of the Eindhoven University of Technology. Announced as "Making the theoretical possible", the talk was given as "MD5 considered harmful today", after Dan Kaminsky's 2004 paper "MD5 to be considered harmful someday". "We think this day has come," they wrote.
An authority vouches for a website by signing a digest of its certificate. In 2008 six authorities still issued certificates signed with MD5, though MD5 collisions had been public since 2004 and in 2007 Stevens had shown how to give two colliding certificates different names. Of some 30,000 certificates the team gathered that were signed by authorities Firefox trusted, about 9,000 used MD5, and 97 per cent of those came from RapidSSL, a brand VeriSign owned. RapidSSL issued automatically, numbered in sequence and signed each certificate "exactly 6 seconds" after the buyer's final click, so its output could be predicted. The team built twins: an ordinary certificate for i.broke.the.internet.and.all.i.got.was.this.t-shirt.phreedom.org, for RapidSSL to sign, and a certificate authority called MD5 Collisions Inc., with the same digest, to carry the signature away.
The collision took more than 200 PlayStation 3 consoles in Lenstra's EPFL laboratory — about 18 hours with 30 GB of memory, then three to ten hours on a quad-core PC — and had to be found in advance, for a certificate not yet signed. So the team forecast a weekend's sales, typically 800 to 1,000 certificates, bought more to bring RapidSSL's serial number to the mark and hoped nobody else ordered in the last 30 seconds. "The first three tries failed due to timing issues," they wrote: some certificates came "signed only a second too late", and other customers' requests interfered. On the fourth weekend, early in November, it worked; the certificates cost $657. Their authority was dated 31 July to 2 September 2004, so browsers would reject it even if its key escaped.
They had briefed Microsoft and Mozilla under non-disclosure agreements, for fear, Wired reported, that legal pressure would be brought to suppress the talk. VeriSign told Wired it was "a little frustrated" to seem "the only people not briefed", and moved the same day: Tim Callan, a vice-president, wrote that RapidSSL had stopped using MD5, and the company said the attack "has been rendered ineffective for all SSL Certificates available from VeriSign". Microsoft's advisory said the disclosure did "not increase risk to customers significantly"; CERT's note of 31 December called MD5 "cryptographically broken and unsuitable for further use". The change covered certificates issued from 30 December, not any forgery made earlier, and of a site presenting one, Mozilla warned that day, "there will be no obvious sign of a problem and the connection will appear to be secure".
A Password at the Registrar
At about 12:30 on the morning of Tuesday 2 December 2008, someone signed in to CheckFree's account at Network Solutions, its domain registrar, with CheckFree's own credentials, and changed the name servers for its domains so that the bill-payment service's visitors went to a server in Ukraine. CheckFree's spokeswoman, Melanie Tolley, said they had met a blank page that tried to install malicious software, through flaws in out-of-date copies of Adobe's Acrobat and Reader. "Somebody got hold of the customer's login information. I don't know how they got access," said Susan Wade of Network Solutions. First reports had CheckFree back in control of its account by 5 a.m.; a month later Computerworld reported visitors redirected from 12:35 to 10:10 a.m. Fiserv, CheckFree's parent, guessed from traffic patterns that about 160,000 people had been exposed and "a very small number" infected; unable to say who, CheckFree and banks using its service warned more than five million, it told New Hampshire's attorney general. On 23 December RBS WorldPay, whose breached network had fed November's cash-machine raid, said personal information on about 1.5 million cardholders, 1.1 million Social Security numbers among it, might have been compromised.
Eight Days Off Schedule
On Tuesday 9 December 2008, the day of Microsoft's monthly security updates, knownsec, a Chinese security team, said it had published exploit code for an unpatched flaw in Internet Explorer 7 by mistake, believing it already fixed: "This is our mistake." VeriSign's security unit iDefense, citing the team's blog, said the code had traded in criminal markets for as much as $15,000. Microsoft's advisory of 10 December was widened the next day to name every version from 5.01 to the beta of 8 as potentially vulnerable; the fault lay in the browser's data-binding code. On 16 December the BBC reported experts urging users to switch browsers until it was fixed. Trend Micro's senior security adviser said as many as 10,000 websites had been compromised, and that the exploit was so far stealing game passwords. Microsoft UK's John Curran put the affected sites at 0.02 per cent: "I cannot recommend people switch due to this one flaw." On 17 December, eight days after its scheduled release, Microsoft published MS08-078, rated critical, saying it had information that the flaw was being exploited.
Fifty-Eight Amendments, No Debate
On Monday 22 December 2008, less than four weeks after the attacks on Mumbai, the Lok Sabha passed the Information Technology (Amendment) Bill without a debate. The bill was not new: introduced on 15 December 2006, it had gone to the Standing Committee on Information Technology, which reported on 7 September 2007. What changed was the text. Notice of fifty-eight government amendments in the name of A. Raja, the communications and IT minister, was signed by the Lok Sabha's secretary-general on 16 December; they renamed it the 2008 bill and added, among much else, an offence of cyber terrorism punishable by up to life imprisonment and a statutory role for CERT-In. For three, Raja gave notice of motions to suspend the rule that an amendment must lie within a bill's scope; one let police inspectors, not deputy superintendents, investigate offences under the Act.
MediaNama, reporting the passage next day, said the melee in the House had centred on "political oneupmanship, rather than legislation"; it linked readers to the 2006 bill and the committee's report and was "trying to locate an updated version". The Rajya Sabha passed the bill on 23 December, by contemporary accounts also without debate, and the Lok Sabha rose for the year. That day PRS Legislative Research reported that the Lok Sabha had passed sixteen of its thirty-six bills of 2008, finance and appropriation bills aside, in less than twenty minutes each, most without any debate, the IT bill among them; the House had sat on 46 days, the fewest in any calendar year. President Pratibha Patil signed the Act on 5 February 2009; what it contained, and when it took effect, are told in October 2009.
Kyoto rebuilds pictures from brain scans
On 11 December 2008 the journal Neuron published a study from Yukiyasu Kamitani's group at ATR Computational Neuroscience Laboratories in Kyoto that recovered simple pictures from brain activity. Two volunteers in a functional MRI scanner watched 440 random patterns, each a ten-by-ten grid of flickering patches shown for six seconds, while sparse logistic regression learned how activity in the early visual cortex tracked each part of the grid, at several scales. The decoders then reconstructed shapes and letters they had not been trained on, spelling out the word neuron, and could pick the pattern on screen from among millions of candidates. On 14 December in Tokyo, after winning the second UEC Cup, Rémi Coulom's Go program Crazy Stone beat Kaori Aoba, a four-dan professional, taking a seven-stone handicap; Netflix that month gave its second $50,000 progress prize to BellKor in BigChaos. Kamitani's group went on to decode dream imagery at the onset of sleep in 2013, and in 2023 researchers at Osaka generated pictures from brain scans with Stable Diffusion.
A Maryland court halts WinFixer's fake scans
On 10 December 2008 the Federal Trade Commission said a federal court in Baltimore had, on 2 December, halted a scareware scheme selling WinFixer, DriveCleaner, XP Antivirus and more, run by Innovative Marketing, incorporated in Belize, and ByteHosting Internet Services of Cincinnati. Posing, it said, as agents for legitimate companies, they had placed advertisements on popular websites, then used hidden code to send visitors to pretended scans reporting viruses, spyware and illegal pornography; more than a million consumers paid $39.95 or more for the cure. The court froze their assets and, on 19 December, fined Innovative Marketing $8,000 a day for defying its orders. Kristy Ross, a vice-president there, alone fought the case to judgment; the rest settled or defaulted. Held liable for $163 million in 2012, she lost her appeal in 2014, the court citing her chat messages telling staff to "add aggression" to advertisements. She had argued that the provision she was sued under allowed no money award; in April 2021, in another case, a unanimous Supreme Court took the same view.
⏳ Time capsule — December 2008
- On 11 December Bernard Madoff was arrested and charged with securities fraud. The SEC's complaint said he had told senior employees that his business was "basically, a giant Ponzi scheme", with losses he himself put at $50 billion or more; he pleaded guilty to eleven felonies on 12 March 2009 and on 29 June was sentenced to 150 years.
- On 12 December Switzerland joined the Schengen area at its land borders, the twenty-fifth country to do so: systematic checks on people crossing from its neighbours ended, though customs checks on goods continued, and checks on passengers at its airports ended in March 2009.
- On 15 December, at the M. A. Chidambaram Stadium in Chennai, India made 387 for 4 to beat England by six wickets, the highest successful fourth-innings chase on the subcontinent. Sachin Tendulkar finished on 103 not out, his 41st Test century, and Yuvraj Singh on 85 not out.
- On 25 December Ghajini opened in Indian cinemas: A. R. Murugadoss's Hindi remake of his own Tamil film of 2005, with Aamir Khan as a man living with anterograde amnesia. It was the first Hindi film to take more than ₹100 crore net in India, and the highest-grossing Indian film until 3 Idiots a year later.
A hash retired by stages
The researchers held back their method until March 2009, to give the authorities time, and MD5 left the web's trust system by stages. In June 2012 Microsoft found its signature forged onto Flame through an MD5 collision, by builders who had worked out their own variant of the chosen-prefix attack. Since 11 February 2014, when automatic updates began delivering the change, Windows has refused any certificate chain containing an MD5 hash under the roots in Microsoft's programme. SHA-1, the successor, took the same road: a practical collision in February 2017, browsers refusing SHA-1 certificates that year and, in January 2020, a chosen-prefix collision for SHA-1 too, which its authors costed at about $45,000. NIST wants SHA-1 retired by 2030, four years from now.
The system itself has been rebuilt on the assumption that authorities fail. The Berlin forgery got round one with arithmetic; in 2011 intruders got round Comodo through a reseller's account in March and DigiNotar through its own systems by September, and Certificate Transparency, which puts issued certificates in public logs, followed. RapidSSL went with the certificate business Symantec had bought from VeriSign to DigiCert in 2017. The month's smaller stories recurred too. Logins at a registrar or DNS provider were turned against Twitter in December 2009 and The New York Times in August 2013, and a campaign of such hijackings drew the first emergency directive from America's cyber-defence agency in January 2019; in January 2010 two governments told their citizens to stop using Internet Explorer, and Microsoft again patched out of band.