Brian Krebs of The Washington Post's Security Fix blog had spent four months gathering what the security industry knew about McColo Corp., a San Jose hosting company. Researchers tied its servers to spam botnets' command systems, to rogue anti-virus sites, to a malicious-software operation that had stolen more than half a million bank and card accounts, and to sites trading in images of child sexual abuse; Arbor Networks had tracked a few dozen botnets phoning home to its addresses. Complaints had changed nothing, so Krebs took his findings to McColo's two upstream providers. Benny Ng, Hurricane Electric's director of marketing, said that when they looked into it they said "Holy cow!", and that "within the hour we had terminated all of our connections to them".
That was Tuesday 11 November 2008, in the afternoon in California. Global Crossing, the other provider, would say only that it worked with law enforcement, its peers and researchers, but it too withdrew. Spam counters moved within hours. SpamCop's fell from about thirty junk messages a second to fewer than fifteen. IronPort, which saw about 190 billion spam messages on an average day, recorded a drop of almost two-thirds that afternoon; Spamhaus saw raw delivery attempts down about 60 per cent, Google's Postini about 70, and Krebs's own headline said two-thirds. Spamhaus noted that reported declines ran from 5 to 90 per cent, but every vantage point saw a fall: the command servers of several of the biggest spam botnets, Srizbi, Rustock, Mega-D and Pushdo among them, had gone dark at once.
McColo tried to return. Over the weekend of 15–16 November it came back through a backup arrangement with Sweden's TeliaSonera, and FireEye estimated that the handlers of another botnet, Rustock, may have reclaimed 10,000 to 15,000 of its machines before that link too was cut. Srizbi, by SecureWorks's reckoning the world's largest botnet, had a fallback of its own. Bots cut off from their masters computed domain names on a three-day cycle and tried each in turn. FireEye reverse-engineered the scheme and registered a couple of hundred of the names first — the precedent February 2009 recalls — until, said its chief security content officer, Fengmin Gong, "we cannot afford to spend so much money". When FireEye stopped, the botnet's handlers registered the five names of the next cycle, and late on Tuesday 25 November the bots reached new servers in Estonia.
The servers lasted about thirteen hours, during which some 100,000 infected machines could reach them, before they were cut off at their Tallinn host, Starline Web Services. "Estonia stepped in in record time," said FireEye's Alex Lanstein, and Hillar Aarelaid of Estonia's CERT said he was satisfied the sites were closed. Srizbi did not last: Krebs later called McColo's disconnection "the beginning of the end" for it, a brief recovery in February 2009 was undone by an update to Microsoft's malicious-software removal tool, and a pharmacy-spam botnet very like it, Xarvester, emerged as it disappeared, by M86 Security's account. Spam came back without it. MessageLabs found spam at 74.6 per cent of email that January, which it put at 80 to 90 per cent of the level before McColo's shutdown; and by the second half of March 2009 Google's seven-day average was back at its pre-McColo level.
Forty-Four Cards
On Saturday 8 November 2008 cash machines in at least 280 cities, from the United States and Canada to Italy, Russia, Ukraine, Estonia, Hong Kong and Japan, began paying out on payroll debit cards, which some employers use for wages. In less than twelve hours more than $9 million left over 2,100 machines. By prosecutors' later account, intruders in the network of RBS WorldPay, the Royal Bank of Scotland's payment-processing arm in Atlanta, had defeated the encryption protecting the cards' data, raised the accounts' limits and supplied 44 counterfeit cards to cashers, who kept 30 to 50 per cent. Two of the accused allegedly watched the withdrawals live from inside RBS WorldPay's systems, then tried to destroy data. The company found the intrusion on 10 November and reported it; cardholders heard in December. On 10 November 2009 a grand jury in Atlanta indicted Sergei Tšurikov of Tallinn, Viktor Pleshchuk of St Petersburg, Oleg Covelin of Chişinău and a fourth, unidentified defendant. Pleshchuk, tried in Russia, received a six-year suspended sentence; Tšurikov, extradited from Estonia in 2010, was sentenced in Atlanta in October 2014 to eleven years and three months.
Four Million Messages
On Friday 21 November 2008, in federal court in San Jose, Judge Jeremy Fogel signed a default judgment ordering a Montreal man and his company to pay Facebook $873 million under the CAN-SPAM Act. It was the act's largest award yet, beyond the $234 million MySpace had won against two other spammers that May. Facebook's suit said he had phished members' passwords and used the captured accounts to send more than four million messages, advertising herbal marijuana and "male enhancement" pills. He did not contest the civil case, and the court barred him from Facebook for good. The company's security director called the award a powerful deterrent but conceded the defendants were unlikely ever to pay it, though Facebook would "collect everything we can". In the autumn of 2010 the Quebec Superior Court declared the judgment enforceable in Quebec, citing the damages Canada's pending anti-spam bill allowed as evidence that the award was not out of line. Reports this archive could find do not say what was collected.
Fix the Site
By the account the Press Trust of India filed from Islamabad, it began in mid-November 2008, when an Indian group known as HMG, or "Guards of Hindustan", defaced the website of Pakistan's Oil and Gas Regulatory Authority and deleted all its data; the same group had earlier taken over Pakistani communities on Orkut, Google's social network. Then, apparently in retaliation, a group calling itself the Pakistan Cyber Army hacked five Indian sites, among them those of the Oil and Natural Gas Corporation, the Indian Institute of Remote Sensing, Indian Railways and the Kendriya Vidyalaya at Ratlam, a government-run school in Madhya Pradesh. PTI also reported that a number of government sites in both countries had been defaced since mid-November. The reports did not say how any of them had been entered.
The school's site changed hands again. By 26 November, IDG News Service reported, Indian hackers had taken it over and left a message for its owner: the site had been hacked by Pakistani hackers, it said, but was now under the control of Indian hackers, and the owner should fix it. The note made the point the whole exchange made: a site its owner does not maintain belongs to whoever arrives next. Those reports appeared on 26 November, the day the attacks on Mumbai began. The Pakistan Cyber Army's name returned two years later, when a group calling itself the Indian Cyber Army defaced some three dozen Pakistani government sites and the Pakistani group answered on the CBI's home page (December 2010). Under CERT-In's directions of April 2022, a defaced website is among the incidents that must be reported within six hours.
Google finds the flu in searches
On 11 November 2008 Google launched Flu Trends, which estimated influenza activity in each American state from flu-related searches. Its engineers had matched weekly counts of the 50 million commonest American queries since 2003 against the Centers for Disease Control and Prevention's figures for doctor visits with flu-like illness; summing 45 queries fitted best, while others in the top hundred, such as "high school basketball", merely coincided with the flu season, their paper noted. Shared with the CDC weekly through the previous winter, the estimates ran one to two weeks ahead of the agency's reports, though a New York City health official saw no evidence they were timelier than the city's emergency-room data. Flu Trends' spread abroad and failure are told in October 2009. On 17 November, after a weekend's delay at Apple's App Store, Google's iPhone application took spoken queries, in American English only: raised to the ear, it listened after a beep, and Google's servers recognised the words. That week DARPA picked IBM's and HRL Laboratories' teams for the first phase of SyNAPSE, its brain-inspired chip programme.
Microsoft drops OneCare for a free Morro
On 18 November 2008 Microsoft said it would stop selling Windows Live OneCare, its $49.95-a-year security and tune-up suite, on 30 June 2009, and would offer in the second half of the year a free product, code-named Morro, against viruses, spyware, rootkits and trojans. Built on the engine of its business products, Morro would leave out OneCare's backup and tune-up tools, run lighter on Windows XP, Vista and 7, and reach developing countries, where, Microsoft said, uptake of anti-malware software was especially low; subscribers would stay protected until their subscriptions ran out. OneCare had won only a small share of the market, and the biggest paid vendors read the change as a retreat. Rowan Trollope, Symantec's consumer chief, called it a capitulation and predicted a free, cut-down OneCare would fare worse than the paid one; McAfee said that "Microsoft has given up". AVG, which already gave a version away, saw no need to change its product. Microsoft's Roger Halbheer later rejected talk of failure, citing the engine's test certifications. Morro arrived as Security Essentials in September 2009.
⏳ Time capsule — November 2008
- On 2 November, at Interlagos in São Paulo, Lewis Hamilton passed Timo Glock in the closing corners of the Brazilian Grand Prix to take the fifth place he needed. Felipe Massa won the race and lost the title by one point, 98 to 97; at 23 years and 300 days Hamilton was Formula One's youngest world champion, until Sebastian Vettel in 2010.
- On 4 November Barack Obama was elected president of the United States, the first African American elected to the office. He beat John McCain by 365 electoral votes to 173 and took 52.9 per cent of the popular vote, on a turnout of 61.6 per cent of eligible voters.
- On 14 November, at 20:31 Indian time, the Moon Impact Probe released by Chandrayaan-1 struck Shackleton crater at the Moon's south pole, carrying images of the Indian flag. ISRO became the fifth space agency to reach the lunar surface, after those of the Soviet Union, the United States, Japan and Europe; the orbiter had entered lunar orbit on 8 November.
- On 14 and 15 November the leaders of the Group of Twenty met for the first time, at the National Building Museum in Washington, with George W. Bush as host, amid the financial crisis. Their declaration set out common principles for reforming financial markets, launched an action plan to carry them out and reaffirmed the leaders' commitment to free-market principles.
Unplugging as a method
McColo's ending became a method. It showed that a botnet's weakest point was the few servers that gave its orders, and that the companies carrying their traffic could move faster than any court; registrars and judges were soon added. FireEye silenced Mega-D through its hosts and registrars, briefly, in November 2009; a sealed order cut Waledac from its domains in February 2010; US marshals carried Rustock's servers out of seven cities in March 2011; Grum's were pulled host by host in July 2012. The operators learned as quickly. Srizbi's computed names were the precedent when Conficker, the worm that arrived on about 21 November, was denied its own 250 a day (February 2009), and a later Kelihos took its orders peer to peer, leaving no server to seize (March 2012).
Spam needed about four months to recover, by Google's count. In February 2026 Kaspersky reported that 44.99 per cent of global email traffic in 2025 had been spam; MessageLabs had counted 74.6 per cent of mail in January 2009. They are two companies' measures, not one series: roughly three messages in four then, one in two now. The month's other stories became patterns. The RBS WorldPay method was used again, for five times the money, against two Gulf banks' prepaid cards in the cases unsealed in May 2013, and through a rogue switch that answered for the bank against Pune's Cosmos Bank in August 2018. Facebook's remedy was used again too: in October 2009 it won $711 million against another spammer.