DarkMarket shut down on Saturday 4 October 2008, as Master Splyntr, one of its administrators, had told its members it would. It was an English-language bazaar where stolen card numbers, bank logins and devices for making counterfeit cards changed hands, and at its peak, the FBI later said, it had more than 2,500 registered members. "It is apparent that this forum … is attracting too much attention from a lot of the world services (agents of FBI, SS, and Interpol)," his notice ran. Members had reason to believe it. In September Turkish police had arrested Cha0, another administrator, whose notoriety the notice blamed. Cha0 sold ATM skimmers and PIN pads that a fraudster could fix covertly to certain models of cash machine, capturing account numbers and the PINs typed into them.
Nine days later they learned who had written it. On Monday 13 October Südwestrundfunk, southwest Germany's public broadcaster, and Wired reported that Master Splyntr was J. Keith Mularski, a senior FBI cybercrime agent at the National Cyber Forensics Training Alliance in Pittsburgh. Kai Laufen, an SWR reporter, had found the name in documents from the case of a German card forger active on the forum; in a March 2007 e-mail to a German counterpart Mularski had put it bluntly: "Master Splynter is me." The handle, a nod to the rat who teaches the Teenage Mutant Ninja Turtles, had belonged to an Eastern European spammer, and Mularski kept up the spammer's persona. DarkMarket was under attack from a rival group, and JiLsi, its founder, was no technician; Mularski set up test sites to show his skills, and one night, during another attack, offered to secure the server. JiLsi agreed to move.
From then on the FBI ran the forum from Pittsburgh, and its new administrator could track who logged in and read what members said to one another. The Bureau built intelligence files on members from their internet addresses and checked them against transaction records from E-Gold, an electronic currency service, Wired reported. The underground had been warned. In late 2006 Max Ray Butler, known as Iceman, who ran the rival CardersMarket, broke into DarkMarket's server and announced that Master Splyntr logged in from the training alliance's offices. Members took it for a rival's smear. Mularski went on the offensive, denying it, and in a forum where members constantly accused one another of being police, he later told CNET, he was able "to create a smoke screen and create doubt."
On Thursday 16 October the FBI announced the end of a two-year undercover operation: 56 arrests worldwide, made with British, Turkish and German authorities, and $70 million in losses prevented, by its own estimate. JiLsi — Renukanth Subramaniam, who had run the site from an internet café in north London — was jailed on 26 February 2010 for four years and eight months for conspiracy to defraud and mortgage fraud; his prosecutor called DarkMarket a "Facebook for fraudsters". Iceman, who had pleaded guilty to wire fraud for his own hacking, had been given thirteen years in Pittsburgh a fortnight earlier. Those never arrested were left with a harder lesson: the notice that blamed the FBI had been posted by the FBI, from a server it ran.
Server Graveyard
On Friday 24 October 2008 Rajendrasinh Makwana, who had worked since 2006 as a contract Unix engineer at Fannie Mae's data centre in Urbana, Maryland, was told it was his last day. Shortly afterwards, by the FBI's account, he had embedded a script in a routine program, beneath about a page of blank lines; held up by procedures in the procurement department, his privileged access was not cut off until late that evening. On Wednesday 29 October a senior engineer found it hidden at the end of the legitimate code. Set for Saturday 31 January 2009, it would have blocked monitoring alerts, disabled logins, removed root password access, overwritten the data and backups on about 4,000 servers with zeros and greeted administrators with "Server Graveyard". Fannie Mae's engineers expected millions of dollars of damage and at least a week's disruption. Makwana was arrested on 7 January and indicted on 27 January, when the papers were made public, four days before the script's date. A jury convicted him on 4 October 2010, and on 17 December he was sentenced to 41 months.
A Borrowed Click
Robert Hansen of SecTheory and Jeremiah Grossman of WhiteHat Security were due to speak at OWASP's AppSec conference in New York on 24 September 2008 about an attack they named clickjacking: a page loads another site in a frame, then hides it or covers it with a decoy, so that a click meant for the decoy lands on the hidden site's button. After talks with Adobe, one of whose products a demonstration used, and with browser makers, they pulled the talk themselves; Hansen wrote that this was not a "the man is trying to keep us hackers down" situation. On 7 October Guy Aharonovsky, an Israeli researcher, posted a demonstration that invisibly reset Flash's privacy settings and switched on a visitor's webcam and microphone. Hansen published twelve scenarios the same day, only two of them resolved, and Adobe issued an advisory; Flash Player 10, released on 15 October, carried its fix. Browsers had none. Microsoft's answer, announced on 27 January 2009 for Internet Explorer 8, was a header, X-Frame-Options, with which a page could refuse to be framed. Every major browser came to obey it, and Content Security Policy's frame-ancestors directive was designed to succeed it.
No Number, No Call
On 6 October 2008 the Department of Telecommunications directed every access service provider to install an equipment identity register, so that calls from handsets with no IMEI, or an IMEI of all zeros, would be rejected. The IMEI is a GSM handset's fifteen-digit serial, printed beneath the battery or shown by dialling *#06#; CDMA phones carry an electronic serial number instead. In 2008, by the later account of the regulator, TRAI, large numbers of phones were found working with neither, or with zeros, a security risk because the security agencies could not trace them, and many networks were not fully equipped to check. A register keeps a white list of genuine numbers and a black list of unauthorised ones, and a switch that queries it can end a blacklisted handset's call.
The idea was older than the order. TRAI had consulted on blocking stolen handsets earlier in the decade and let it drop: many operators had no register, and an IMEI could be reprogrammed. The operators argued that a law against reprogramming was needed; Britain had had one since 2002. After the order the operators installed registers, TRAI later noted, but the phones themselves were not cut off until the night of 30 November 2009, as November 2009 records. The law took longer. Rules notified on 25 August 2017 made it unlawful for anyone but the manufacturer to alter an IMEI, punishable under the Telegraph Act by up to three years, and section 42 of the Telecommunications Act, 2023, now forbids tampering with any telecommunication identifier, on pain of up to three years, a fine of up to ₹50 lakh, or both.
Elbot fools three of its twelve judges
On 12 October 2008, at the University of Reading, the eighteenth Loebner Prize put five chat programs, whittled down from thirteen entries, through Turing's imitation game. Each judge conversed by keyboard with two hidden partners at once on a split screen, usually a program and a person, and after five minutes said which was the machine. Elbot, built by Fred Roberts with Artificial Solutions, a maker of customer-service bots, persuaded three of the twelve judges who questioned it that it was the human: 25 per cent, short of the 30 per cent the organisers took from Turing's 1950 paper as a pass. It won the bronze medal and $3,000 from Hugh Loebner. "I don't think it's anything like thought," Roberts said. Eugene Goostman, another finalist, was the program for which Kevin Warwick, the organiser, claimed a pass in June 2014, to wide dispute; in March 2025 researchers at UC San Diego reported that GPT-4.5, told to adopt a persona, was picked as the human 73 per cent of the time in five-minute, three-party tests of the same design.
Symantec buys MessageLabs for $695 million
On 8 October 2008 Symantec agreed to buy MessageLabs, of Gloucester, for about $695 million in cash. MessageLabs cleaned its clients' email of spam and viruses in fourteen data centres before delivering it; it had more than 19,000 clients, eight million users and about $145 million in revenue in the year to July. Symantec, building a software-as-a-service business, completed the purchase on 14 November; renamed Symantec.cloud in 2011, the service went to Broadcom in the sale agreed in August 2019. On 13 October Secunia, a Danish vulnerability tracker, reported that twelve security suites had missed most of 300 exploits for flaws in common programs: Norton Internet Security 2009 detected 64, none of the others more than 3 per cent. Thomas Kristensen, Secunia's chief technology officer, said suites marketed themselves as "the one solution users need to be safe online" and were not. Vendors and testers objected that the files had been scanned, never run; Secunia replied that catching an attack before it ran was better. AV-Comparatives began testing with live attacks in December 2009.
⏳ Time capsule — October 2008
- On 7 October, about twenty hours after Richard Kowalski of the Catalina Sky Survey spotted it from Mount Lemmon in Arizona, an asteroid about four metres across, 2008 TC3, struck the atmosphere above the Nubian Desert in Sudan at 02:46 UTC: the first impact predicted before an asteroid reached the atmosphere. From 6 December searchers led by Peter Jenniskens of the SETI Institute and Muawia Shaddad of the University of Khartoum began recovering its fragments, some 600 in all.
- On 14 October Aravind Adiga, 33, won the Man Booker Prize and £50,000 with his first novel, The White Tiger, in which a driver, Balram Halwai, tells his life in a letter written over seven nights to China's premier. Michael Portillo chaired the judges; Amitav Ghosh's Sea of Poppies was also on the shortlist.
- On 17 October, the first day of the second Test against Australia at Mohali, Sachin Tendulkar steered Peter Siddle for three immediately after tea and passed Brian Lara's record of 11,953 Test runs. He made 88. "It is definitely the biggest achievement in 19 years of my career," he said.
- On 29 October, in Bonn, Viswanathan Anand drew the eleventh game of his world championship match against Vladimir Kramnik and kept the title, 6½–4½, with the twelfth game not needed; he had won three games to Kramnik's one.
Who Runs the Market
The method had a precedent — the Secret Service had watched ShadowCrew through an informant until 2004, as August 2009 recalls — but at DarkMarket an agent kept the server. In June 2010 the FBI built its own carding forum, Carder Profit, configured to record every thread, private message and visitor's internet address; Operation Card Shop ended in 24 arrests on 26 June 2012, thirteen of them abroad. Dutch police ran Hansa for twenty-seven days, as July 2017 records, and in February 2024 a coalition led by Britain's National Crime Agency used LockBit's leak site to publish what it knew of the gang. The target had widened from arrests to trust. Mularski left the FBI after more than twenty years for private-sector cybersecurity work, beginning as a managing director at Ernst & Young.
The month's other stories have their sequels too. Fannie Mae's script went in during the hours between a dismissal and the end of an engineer's access, and access that outlives a job returned in December 2020, when Ticketmaster agreed to a $10 million penalty after a rival's former employee brought his old passwords with him. Clickjacking's defence became a header, documented by the IETF as RFC 7034 in October 2013 and obeyed by every major browser, but only when a site remembers to send it. And the month's most consequential patch, MS08-067, issued out of band on 23 October, is told with the worm that used it in January 2009.