At about half past three on the afternoon of 23 December 2015, substation after substation in western Ukraine dropped off the network, and the people paid to watch them could do nothing about it. At Prykarpattyaoblenergo, which distributes electricity across the Ivano-Frankivsk region, an operator was logged out of his own console and found his password no longer worked. The same half hour ran through two more regional distributors, Kyivoblenergo and Chernivtsioblenergo. American investigators later put the total at approximately 225,000 customers, without power for between one and six hours. The count is of accounts rather than of people. It was two days before Christmas, in a Ukrainian winter, on one of the shortest afternoons of the year.
The rest of that day was built to keep the lights off longer. The utilities' telephone lines filled with a flood of automated calls, so that genuine customers could not get through to report the outage. The backup power feeding a control centre was switched off through the battery units' own remote management interface, so the dispatchers' room went down with the grid it was meant to restore. A wiper called KillDisk destroyed files on the operator workstations. And the firmware in the converters that carry commands from a control room out to a substation was overwritten with junk, which decided the recovery: engineers drove out to the substations and worked the breakers by hand.
What December could offer was an allegation, not a finding. The companies said publicly only that outside interference had taken away their view of their own network. Ukraine's security service said within days that malicious software had been found in the networks of regional power companies, that a sustained flood of calls had accompanied the outage, and that Russian special services were responsible; the energy ministry convened a commission. No forensic report existed yet, and the researchers who would write one stayed out of December: ESET's first published analysis of the attack on the Ukrainian power industry, by Robert Lipovsky, did not appear until 4 January. A reader at the end of that month had a blackout, a wiper, a jammed switchboard and an accusation, and nothing published joining them.
The joining was January's business, and that edition carries it: the analyses of the new year's first weeks, and the American confirmation on 25 February that remote intrusions at three distributors had caused the outages. This archive dates the first publicly acknowledged cyber-caused blackout to that afternoon. The sequel came inside a year, at a transmission substation north of Kyiv, and lasted about seventy-five minutes; the malware behind that one was named in June 2017. In October 2020 a United States grand jury indicted six officers of the GRU's Unit 74455 over both blackouts. None has been arrested, Russia has denied all of it, and in April 2022 a descendant of the same code was found inside a Ukrainian energy company and stopped before it fired.
Code nobody there wrote
On 17 December 2015 Juniper Networks published an out-of-cycle bulletin: an internal code review had turned up unauthorised code in ScreenOS, the operating system on its NetScreen firewalls. There were two separate problems. One let an attacker take administrative control of a device over SSH or Telnet; the other could let anyone able to monitor VPN traffic decrypt it, and Juniper said there was no way to tell whether it had been. Rapid7 had the first within three days — a hard-coded password disguised to read like a debugging format string, present in ScreenOS 6.3.0r17 through 6.3.0r20 and introduced, on their analysis, in a release from late 2013. The second was older. ScreenOS drew its random numbers from Dual_EC, the algorithm the Snowden documents were reported to have identified as deliberately weakened, and in 2012 somebody substituted a constant of their own. On 22 December the cryptographer Matthew Green showed how a further bug put raw Dual_EC output on the wire: a back door inherited by whoever came next. Juniper's remedy belongs to January. On 18 December, the day after the bulletin, the omnibus appropriations bill carrying the Cybersecurity Act of 2015 was signed into law.
Nobody had to break in
The month's largest exposures involved no intrusion. Chris Vickery, working in Austin, Texas, spent December querying Shodan for MongoDB databases left running without a password. On 14 December Brian Krebs reported the first, thirteen million MacKeeper customer records. On 19 December came sanriotown.com, the Hello Kitty fan site: about 3.3 million accounts, of which 186,261 belonged to people under eighteen, with birthdays, email addresses, unsalted password hashes and password-recovery answers. Sanrio said within days that it had fixed the problem and that no fan data had been stolen; in January 2017 the same records surfaced online, which settled the question of whether anyone else had taken a copy. On 28 December the largest was published: 191,337,174 United States voter registration records, 300 gigabytes of names, addresses, dates of birth, telephone numbers and voting histories back to 2000. Every organisation asked denied owning it, and no owner has been publicly identified since. Earlier in the month, first reported on 11 December, Twitter had begun warning a small group of activists and researchers that actors possibly associated with a government might be after their email addresses, IP addresses and phone numbers.
A button that wrote to the regulator
On 9 December 2015 the Telecom Regulatory Authority of India issued a consultation paper on differential pricing for data services — whether an operator should be allowed to charge for data according to the site reached — with comments due by month's end. It landed on an argument already running. Free Basics, Facebook's bundle of approved sites carried without data charges by Reliance Communications, was caught by it directly: on 23 December Reliance confirmed that, at TRAI's direction, the commercial launch had been kept in abeyance pending the consultation. Facebook had already answered with a campaign: notifications inside the app that opened a pre-written message of support to the regulator, billboards, and full-page advertisements listing why the service did not offend net neutrality. On 28 December Mark Zuckerberg argued the case himself in The Times of India, under the banner of digital equality.
Against it stood SaveTheInternet.in, a volunteer coalition with no money for billboards, which answered the advertisements point by point and ran its own email campaign: the objection was never that free was bad, but that one company would choose which internet was free. What reached TRAI was largely identical text, and the regulator said so — its letter of 18 January 2016 accused Facebook of turning a consultation into a crudely majoritarian and orchestrated opinion poll whose templated messages answered none of the questions asked. The counts never reconciled: Facebook spoke of millions of supporters, TRAI of far fewer submissions. The regulation of 8 February 2016 prohibited discriminatory tariffs outright and Free Basics left India within days. The month's quieter beginning came on 27 December, when Reliance Jio switched on its 4G network as a beta for employees and partners — the first step toward the data-price collapse of September 2016.
A billion pledged, not received
On 11 December 2015 a laboratory called OpenAI was announced, a non-profit co-chaired by Sam Altman and Elon Musk, with Greg Brockman as chief technology officer and Ilya Sutskever, lately of Google, as research director. Its stated goal was to advance digital intelligence for the benefit of humanity as a whole, with no obligation to earn a return. The billion dollars attached to it, from the founders, Peter Thiel, Amazon Web Services, Infosys and YC Research, was pledged rather than deposited; tax filings later showed about $133 million actually arriving by 2021. The week around it was larger than the announcement suggested. On 10 December four Microsoft Research authors posted the residual-networks paper behind that year's winning ImageNet classifier, a stack 152 layers deep at 3.57 per cent error, and Facebook published its Big Sur training server, eight Nvidia Tesla M40 cards to a chassis, promising the drawings to the Open Compute Project. The non-profit took on a capped for-profit arm in 2019, shipped ChatGPT in November 2022, and now supplies most of what this archive's later AI desks report.
The extension that came with the scanner
On 15 December 2015 Tavis Ormandy of Google's Project Zero filed a report on AVG Web TuneUp, a Chrome extension installed alongside AVG's anti-virus on 9,050,432 machines. Its added JavaScript interfaces broke the same-origin policy: a fault in one let any site run script in the context of any other, so a visited page could reach a user's open webmail, and a second gave up browsing history. Ormandy rejected AVG's first remedy, which checked only that the calling origin contained the string .avg.com. Version 4.2.5.169 fixed it, Google stopped the extension being installed from outside its store, and the report became public at the end of the month. It was the month's second such finding. On 10 December the firm enSilo reported that AVG Internet Security 2015, McAfee VirusScan Enterprise 8.8 and Kaspersky Total Security 2015 each reserved a writable, executable page at a fixed address, the predictable target Windows randomisation exists to deny. All three had shipped fixes. Ormandy's audit of anti-virus software ran on into 2016; that a scanner is itself attack surface stopped being arguable.
⏳ Time capsule — December 2015
- Rain that began on 1 December put much of Chennai under water; the airport stayed shut until 6 December, more than 1.8 million people were displaced across the region, and the confirmed toll in Tamil Nadu ran past four hundred.
- On 12 December, at Le Bourget outside Paris, the parties to the UN climate convention adopted the Paris Agreement, committing to hold warming well below 2 °C above pre-industrial levels and to pursue 1.5 °C; it entered into force on 4 November 2016.
- Star Wars: The Force Awakens premiered in Hollywood on 14 December and opened in the United States on 18 December; it finished on $2.071 billion worldwide and became the highest-grossing release ever in the United States and Canada.
- On the evening of 21 December a Falcon 9 carried eleven Orbcomm satellites to orbit from Cape Canaveral, and its first stage flew back and landed upright at Landing Zone 1 — the first orbital-class booster to do so.
The switch and the wrench
A decade on, the afternoon of 23 December 2015 keeps the title this edition gives it, and the accusation Ukraine made within days, on evidence it did not then show, has since been adopted by the United States government and a grand jury in October 2020. Russia has never accepted it, and none of the six named officers has faced a court. The technical lesson has aged better than the legal one. That grid recovered in hours because it could still be operated by people standing next to the equipment, an observation repeated in every utility boardroom since, usually by people whose own systems can no longer be run that way. The sequel of December 2016 was shorter and far more automatic, which was rather the point.
The quieter stories of that December hardened into rules. Juniper announced in January that it would strip Dual_EC out of ScreenOS, and finished the job later in 2016; who changed the constant in 2012, and who added the password afterwards, has never been answered in public, and the episode remains the plainest argument that a back door cannot be reserved for its author. Searching for unlocked databases became a genre — the breach with no burglar — and the 186,261 children in Sanrio's records are precisely the category that India's DPDP Act now fences off behind verifiable parental consent. And India's two December stories ran into each other: the regulator refused to let one company give away a curated internet, and nine months later the employee beta of 27 December helped make the whole one cheap enough to change the question.