On Tuesday 13 May 2008 Debian published security advisory DSA-1571. "Luciano Bello discovered that the random number generator in Debian's openssl package is predictable," it began, and the cause was "an incorrect Debian-specific change". Bello, an Argentine security researcher who had become a Debian developer in 2007, had noticed the problem that month. Every key generated with the package since version 0.9.8c-1 reached Debian's unstable branch on 17 September 2006 was to be recreated from scratch: SSH and OpenVPN keys, DNSSEC keys, the keys behind X.509 certificates. Ubuntu, which is built from Debian, published its own notice the same day for its 7.04, 7.10 and 8.04 releases. Keys made with GnuPG or GnuTLS were not affected.
The change was two years old and meant to ease debugging. OpenSSL's random-number code deliberately stirred in a buffer whether or not it had been initialised, which set off warnings in memory checkers such as Valgrind and Purify. On 1 May 2006 Debian's maintainer of the package asked the openssl-dev mailing list about removing two lines behind the warnings. "If it helps with debugging, I'm in favor of removing them," an OpenSSL developer replied that evening. Both were commented out. One sat in the routine that added seed material to the pool, which thereafter went on counting each seed towards its estimate of entropy without mixing the seed in; what was left to vary was the process ID folded in whenever random bytes were drawn, on Linux a number from 1 to 32,767.
So any key made with the package was one of 32,767 for its type, size and processor architecture, and the lists could be computed. Within days HD Moore of the Metasploit project had published SSH keys for every process ID on x86 machines; the 1024-bit DSA and 2048-bit RSA sets took two hours on 31 processor cores. DSA keys fared worst: the algorithm needs a fresh secret random number for every signature, so even a sound key used from an affected machine had to be presumed compromised. Debian shipped blacklists of weak keys and a checker, ssh-vulnkey. Its administrators switched off key logins on every project machine "until further notice", randomised developers' passwords, and replaced db.debian.org's certificate, whose signing authority had itself been made with the bug.
The fix was one package upgrade; the keys were another matter, since a patched library could not mend a key already made. Researchers at the University of California, San Diego, scanning more than 50,000 secure web servers daily from day four after the advisory, found 751 with weak certificates; almost six months later 30 per cent of those first seen vulnerable still were, and certificate authorities went on certifying weak keys. In July Bello and two colleagues showed that even sessions using ephemeral Diffie–Hellman keys could be decrypted if either end ran the broken library. On 8 August Ben Laurie of Google and Richard Clayton of Cambridge warned that OpenID providers, Sun's among them, still served weak certificates which, with the DNS flaw disclosed in July, would let an attacker impersonate them.
Five Hours at the Registrar
Overnight from Wednesday 28 May 2008, for more than five hours, people who typed comcast.net, some five million a day by prosecutors' later count, reached a page announcing "KRYOGENIKS Defiant and EBK RoXed COMCAST" instead of their portal, webmail and voicemail. Comcast said the domain's registration information had been changed at Network Solutions, its registrar, to point at the intruders' address. Engineers restored it; by late Thursday morning most people could reach the site, though some whose DNS servers had not caught up still met errors. A Comcast spokesman said there was no evidence that it had been anything but a defacement. An indictment returned in Philadelphia in November 2009 set out the method: two telephone calls that yielded the information needed, a login to a Comcast email account from which the registrar could be contacted, then the change. Two of the three men charged were each sentenced in Philadelphia on 24 September 2010 to 18 months and ordered to pay $89,578.13 in restitution; the indictment had put Comcast's loss at $128,578. The third, whose case moved to the Western District of Washington, received four months.
A Crime in the Terms
On 15 May 2008 a grand jury in Los Angeles indicted Lori Drew, 49, of O'Fallon, Missouri, on one count of conspiracy and three of accessing protected computers without authorisation to obtain information to inflict emotional distress. Prosecutors said that in 2006 she and others had registered a MySpace account as a fictitious 16-year-old boy and used it for about four weeks to court a 13-year-old girl, then ended it; the girl took her own life. Missouri prosecutors had found no law to charge under. The federal case, brought where MySpace's servers stood, held that breaking the site's terms of service, which forbade false registration and harassment, made the access unauthorised under the Computer Fraud and Abuse Act. Jennifer Granick of the Electronic Frontier Foundation called it a novel and extreme reading of the law, one that made registering under a false name a crime. On 26 November a jury acquitted her of the felonies, convicted her of three misdemeanours and deadlocked on conspiracy. On 2 July 2009 Judge George Wu said he would acquit: "It basically leaves it up to a website owner to determine what is a crime." His written ruling of 28 August held the theory void for vagueness; the government did not appeal.
Thirty-Eight Hours on Baazee
On 29 May 2008 Justice S. Muralidhar of the Delhi High Court ruled on a listing that had stood for about 38 hours. On the evening of 27 November 2004 a seller had offered, on Baazee.com, eBay's Indian auction site, copies of an obscene video clip involving two school students, filed under books and magazines as an e-book. The seller sent the clip to buyers directly, but Baazee took the payments, ₹128 a copy, ₹3 of it in the site's own charges, on eight sales before the listing came down at about 10.38 a.m. on 29 November. Its filters matched listings against banned and suspect words; investigators, the judgment recorded, had found them "grossly inadequate". That December police arrested the company's managing director, a US citizen, under section 67 of the IT Act and the Penal Code's obscenity sections; the High Court bailed him on 21 December.
The 2008 judgment discharged him of the Penal Code offences but let a prima facie case under section 67, read with section 85, which makes those running a company answerable for its offences, proceed, though the company itself had never been charged. Sites offering space for listings, the judge observed, might need content filters to show they had not knowingly permitted such sales. On 27 April 2012 the Supreme Court set the prosecution aside, since the company was not on trial. By then section 79, rewritten by the amendments of December 2008, gave intermediaries a safe harbour if they observed due diligence and removed unlawful material once notified; rules in April 2011 defined the diligence, and in March 2015 the Supreme Court read the notice down to a court order or government direction.
Sixty nouns and a trillion words
The issue of Science dated 30 May 2008 carried a model that predicted, rather than recognised, the brain activity a word would produce. Tom Mitchell and Marcel Just of Carnegie Mellon University had nine volunteers hold sixty concrete nouns in mind in an fMRI scanner; a corpus of more than a trillion words supplied how each noun behaved, and the two together predicted the scan for nouns the model had never seen. It matched prediction to observation seventy-seven per cent of the time, and seventy per cent on categories withheld from training. Mitchell said the team had identified "a number of the basic building blocks that the brain uses to represent meaning"; fifteen years on, decoders built on the same idea were recovering the gist of continuous language from scans. Google's research blog had set out VisualRank on 1 May, ranking image results by a PageRank-like pass over inferred visual similarity; on 13 May Honda's ASIMO conducted the Detroit Symphony Orchestra in The Impossible Dream, copying a routine learned months earlier from its education director.
Top of the table, no certificate
AV-Comparatives' eighteenth comparative, last revised on 31 May 2008, was the retrospective half of its February test: sixteen desktop scanners, frozen with the signatures they held on 4 February 2008, set against malware collected in the week that followed, to see what they caught without an update. Sophos detected the most, about seventy-four per cent of the samples, and received no certificate at all, because the same settings raised roughly four hundred false alarms in the laboratory's clean set; Avira, second on detection, and ESET's NOD32 took the only two Advanced+ ratings, and McAfee alone raised none. Andreas Clementi's report found false alarms up generally, and suggested that vendors had begun "blacklisting packers/cryptors" and leaning on generic detection to lift their scores. Two footnotes recorded unreleased engines: Kaspersky's coming version 8 would have roughly doubled its shipping product's twenty-one per cent, and a preview of Symantec's improved technology reached about forty-one. The laboratory promised to start judging behaviour-based protection the following year; tests that run malware against the whole product have been the trade's measure ever since.
⏳ Time capsule — May 2008
- On 2 May Iron Man opened in American cinemas, with Jon Favreau directing Robert Downey Jr. as Tony Stark. It took $98.6 million in the United States and Canada over its first weekend and $585.8 million worldwide, and it was the first film of what became the Marvel Cinematic Universe; in a scene after the credits Samuel L. Jackson's Nick Fury arrives to talk about the "Avenger Initiative".
- On 3 May Microsoft withdrew the offer for Yahoo it had first made on 31 January. It had gone as high as $33 a share; Yahoo wanted at least $4 a share more, about $5 billion, and Steve Ballmer said the economics Yahoo demanded did not make sense for Microsoft. Yahoo's operating business went to Verizon in June 2017, after the breaches told in September 2016.
- On 25 May NASA's Phoenix lander came down on the plains of Vastitas Borealis, at about 68 degrees north, the first spacecraft to land in Mars's polar region. Within weeks its digging had exposed bright clumps that vaporised over four days, the water ice it had been sent to study; its last signal reached Earth on 2 November.
- On 28 May Nepal's Constituent Assembly, elected on 10 April, voted at its first session by 560 to 4 to make the country a federal democratic republic, ending the monarchy. King Gyanendra was given fifteen days to leave the Narayanhiti palace, and left on 11 June.
Keys That Outlived the Fix
The weak keys outlived the patch by more than a decade. Internet-wide scans in October 2011 and early 2012 by Nadia Heninger, Zakir Durumeric, Eric Wustrow and J. Alex Halderman still found Debian weak keys on 4,147 TLS hosts and on about a third of one per cent of SSH hosts. In March 2020 a certificate authority was reported to have just issued a certificate for a key on Debian's list, and from 17 September 2020 Let's Encrypt accepted RSA keys only of 2048, 3072 or 4096 bits, sizes it could check. On 12 May 2024 Hanno Böck reported 855 vulnerable DKIM records among 355,055 collected from the million most popular domains, some published under cisco.com and oracle.com; with them, forged mail could pass DMARC checks in those domains' names.
Debian's error lay in a distributor's patch; OpenSSL's own thin resources became the theme of Heartbleed in April 2014, and key generation failed again, in Infineon's chips, with ROCA in October 2017. The month's other threads ran on. Comcast's five hours have successors in this archive: CheckFree's in December 2008, and The New York Times's at Melbourne IT in August 2013. The question Lori Drew's case raised went higher. Van Buren v. United States, decided six to three on 3 June 2021, confined "exceeds authorized access" to parts of a computer that are off-limits, and on 19 May 2022 the Justice Department listed using a pseudonym on a social network that forbids them among conduct it would not charge, a road this archive follows in January 2013.