Window's Source Released - safer or not?

Topher · Post by **Topher** » Thu Feb 12, 2004 11:35 pm

So what do people think? Attackers now know all the exploits or people can find the exploits and send them to MS to get fixed kind of how Linux works?

Vindicator · Post by **Vindicator** » Thu Feb 12, 2004 11:42 pm

Given the track record of exploits in Windows, I think we're screwed.

Delkian · Post by **Delkian** » Fri Feb 13, 2004 4:06 am

Firstly, wouldn't it be more like 'leaked' than 'released'? Secondly, is there some confirmation regarding this, other than the news on Slashdot and that neowin.net site?

DarkShadow · Post by **DarkShadow** » Fri Feb 13, 2004 8:49 am

<BLOCKQUOTE>quote:<HR>Originally posted by Delkian:
Firstly, wouldn't it be more like 'leaked' than 'released'? Secondly, is there some confirmation regarding this, other than the news on Slashdot and that neowin.net site?<HR></BLOCKQUOTE>

http://www.microsoft.com/presspass/default.asp

February 12, 2004 7:30 p.m. PST
Statement from Microsoft Regarding Illegal Posting of Windows Source Code
The company is investigating these postings, and is working with law-enforcement authorities. At this time, there is no known impact on customers.

CDN_Merlin · Post by **CDN_Merlin** » Fri Feb 13, 2004 9:07 am

As if they'd tell us that we would be in danger of having our sysrtems comprimised.

Tyranny · Post by **Tyranny** » Fri Feb 13, 2004 9:15 am

incentive to get all the loopholes and backdoor vulnerabilities they've been neglecting fixed

MD-2389 · Post by **MD-2389** » Fri Feb 13, 2004 1:36 pm

Guys, only bits and pieces of code that looks like it came from Microsoft got released. It has not been confirmed or denied that it is actual Microsoft Windows 2000 code, so no red alert sirens...mmmk?

Topher · Post by **Topher** » Fri Feb 13, 2004 3:25 pm

http://www.microsoft.com/presspass/pres ... source.asp
http://news.google.com/news?num=30&hl=e ... 2c00%2easp

Don't be so anxious to jump to the conclusion that we are jumping to conclusions....right.

It was about 15% of the total Windows source code, it includes things like IE and WinSock.

DCrazy · Post by **DCrazy** » Fri Feb 13, 2004 10:05 pm

...and apparently a large portion of MS Paint.

Kyouryuu · Post by **Kyouryuu** » Fri Feb 13, 2004 10:39 pm

It's not at all like Linux for one reason - the code is still maintained in a closed format. If hackers find ways to use the vulnerabilities in Windows, we're still on Microsoft's hook to actually fix them.

MD-2389 · Post by **MD-2389** » Sat Feb 14, 2004 11:58 pm

<BLOCKQUOTE>quote:<HR>Originally posted by Topher:
 Don't be so anxious to jump to the conclusion that we are jumping to conclusions....right.

It was about 15% of the total Windows source code, it includes things like IE and WinSock.

<HR></BLOCKQUOTE>

http://zdnet.com.com/2100-1104_2-515849 ... d.newsfeed

<BLOCKQUOTE>quote:<HR> Microsoft is investigating the possibility that a file posted to several underground sites and chat rooms contains some protected source code to Windows 2000.
The 203MB file contains the code that appears to be from Microsoft's enterprise operating system, but the code is not complete, said Dragos Ruiu, a security consultant and the organizer of the CanSecWest security conference, who has examined the file listing.

"It was on the peer-to-peer networks and IRC (Internet relay chat) today," Ruiu said. "Everybody has got it; it's widespread now."

The 203MB file expands to just under 660MB, he said, noting that the final code size almost perfectly matches the capacity of a typical CD-ROM. The entire source code, he said, is believed to be about 40GB, meaning that the file circulating Thursday would be only a fraction of the full code base--if it is authentic.

Ruiu, who has seen the file, believes it to be authentic. "It looks real," he said. "You can't build Windows, however. It's just a bunch of chunks of the operating system."

Microsoft said it is looking into claims that file traders were swapping its proprietary source code.

"The rumor regarding the availability of Windows source code is based on the speculation of an individual who saw a small section of unidentified code and thought it looked like Windows code," Microsoft said in a statement. "Microsoft is looking into this as a matter of due diligence."

Earlier Thursday, a source located a file purporting to be the code on a Web site, but the file was removed from the Internet before it could be completely downloaded.

The possibility that the source code was released created a buzz on the Internet but also worried some security experts.

"It's definitely not a good thing if black hats have the source code," said Oliver Friedrichs, senior manager with antivirus company Symantec's security response center. If the source code has been released, "the underground can look at the code without legitimate security researchers being able to find vulnerabilities first."

But Microsoft downplayed any security issue.

In its statement the company said the main concern is the potential theft of its handiwork rather than the possible security threat that such a leak might pose.

"If a small section of Windows source code were to be available, it would be a matter of intellectual property rights rather than security," Microsoft said.

Microsoft zealously guards the source code to the various versions of its Windows operating system, sharing it only with universities and government agencies that sign agreements not to release the code. While working versions of Microsoft's operating system have occasionally leaked to the Internet, actual source code leaks have been rare.

Although Microsoft Chairman Bill Gates has publicly bragged about the security of Windows, even Microsoft fears the release of its code. In testimony during the Microsoft antitrust trial, Jim Allchin, the company's senior vice president for Windows, said opening up the company's source code could be devastating for the operating system's security.

"The more (that) creators of viruses know about how antivirus mechanisms in Windows operating systems work, the easier it will be to create viruses or disable or destroy those mechanisms," Allchin testified during a May 2002 antitrust trial.

Allchin made the statements while defending the company against legal remedies supported by nine states that would have compelled Microsoft to give away the source code to Internet Explorer.

Allchin's fears are not misplaced, said Thor Larholm, senior security researcher with security consultancy PiVX Solutions.

"Just look at the amount of vulnerabilities that are discovered without the source code," he said. "The majority of Windows servers are still running Windows 2000. Furthermore, Windows 2000 has a lot of shared code that is still being used by Windows XP and Windows Server 2003."

However, other security experts believe that fears about a leak leading to the widespread discovery of vulnerabilities in the code are misplaced.

"Theoretically, to a good reverse engineer, all code is open source," said a Microsoft security consultant who asked not to be identified. He added that the size of the compressed file that was being passed around the Internet sounded about right.

In the end, however, the mistake that made Microsoft's code public might result in benefits similar to open-source code, Ruiu said.

"Short term, there might be problem (as bugs are found), but long term it might be good for them," he said. "Their code might become more secure."

CNET News.com's Ina Fried contributed to this report.<HR></BLOCKQUOTE>

That where I got my info Toph. Emphasis mine.

Ferno · Post by **Ferno** » Sun Feb 15, 2004 1:14 am

40GB source? holy!

fliptw · Post by **fliptw** » Sun Feb 15, 2004 3:02 am

Considering that we got to the moon on something that would've been very, very, very lonely on a floppy disk.

the source for the linux kernel itself uncompressed is 300 megs.

But I wouldn't be surprised if all the sources for your standard Red Hat install got up there either.