Slashdot Mirror
Windows 2000 & Windows NT 4 Source Code Leaks
PeterHammer writes "Neowin.net is reporting that Windows 2000 and Windows NT source code has been leaked to the internet. More on this as we hear it."
← Back to Stories (view on slashdot.org)
← Back to Stories (view on slashdot.org)
A quick peek around indeed shows something named Windows.Source.Code.w2k.nt4.wxp.tar circulating, but this had to happen sooner or later, considering the number of institutions with access to the source. Wonder how long it'll take before a torrent of new worms using newly discovered security holes tear up the net.
I for one would love to peek around in this, more out of curiosity than any desire to actually do something useful with it.
The next great MMORPG.
Now will everyone stop bitching about Windows not being open source?!
Later isn't going to work, since the server was down even before it hit the Slashdot front page. I empathize with their server.
I did, however, managed to grab the news blurb (but not the, at that point, 214 comments) from the intermittent front page:
Torrent, anyone?
I had but a simple dream, to destroy all humans.
There's plenty of worthless spam on the internet already.
I've been upgraded to "bad"!
Full file listing with sizes: http://heim.ifi.uio.no/~mortehu/files.txt I suggest mirroring ;)
Tim Dorr
Owner/Manger
A Small Orange
Seriously, the previous article lambasting open source for being vulnerable is nothing when compared to eyes backed with malicious intent poring over Windows source code for new exploits. So much for security through ignorance.
A feeling of having made the same mistake before: Deja Foobar
I want a ebuild!
emerge win2000
The funny thing is the fortune that appeared in the appropriate slashbox when I first saw this article.
;-)
"Never trust an operating system you don't have sources for.
-- Unknown source"
Mirror with comments.
Hope it's all just a bluff.
"Oppression and harassment is a small price to pay to live in the land of the free." -- Montgomery Burns.
...Windows 2000 and Windows NT source code has been leaked to the internet.
The Internet, however, being a polite sort of fellow and completely undesirous of the undoubtedly horrible ramifications of having such a beastie running around loose, gently replaced the source code and gave Windows a friendly pat on the head.
I watched C-beams glitter in the dark near the Tannhauser gate.
Do NOT read that code if you ever wish to program for an open source OS, ever. Doing so will make you tainted- you open the project up to allegations of copyright infringement. Unless you never want to contribute a single line to Linux, *BSD, etc, checking out that code is a bad idea. Its almost a surprise MS didn't "leak" Win 95 or 3.1 years ago to catch open source developers like this.
I still have more fans than freaks. WTF is wrong with you people?
It *amazes* me that it hasn't been routine.
Windows source code is not some deep dark secret that is locked in a vault, only let out during builds for the product releases.
*MANY* people have access to the Windows source code. A number of people in my own university have it. There are strict licensing considerations, but when has that ever worked before? Surprisingly, none of the people with source access has ever pulled off the stunt where it's broadcasted. I have always wondered why.
-fb Everything not expressly forbidden is now mandatory.
We all know the real valuable stuff is in error.h.
So, what does it say?
This pretty much destroy's any argument that Windows is more secure because "the bad guys" can't look at the source code. And yet it won't get the positive aspect of "the good guys" reviewing the source code for bugs as it is illegal to make a copy of the code without a license to do so.
This is not good. Windows is designed primarily with 'security by obscurity' in mind. The security holes indeed show up every often and we have worms making it to the gazillion windows boxes before the patch does. Get ready for a deluge of worms/virri. Another bad week/month for sysadmins.
Free XBox, PS2
While you may not have heard of Neowin before, they are actually quite well known and are often placed in those '100 essential sites' lists.
They focus primarily on windows tech, and have a knack for breaking stories about Windows- leaked builds of future versions, beta builds of service packs, etc. Whoever runs the site is well connected in Microsoft.
-Ryan
AUWYHSTOT (Acronyms are Useless When You Have to Spell Them Out Too)
I haven't been able to even get to Neowin, it's been slashdotted since before this story even made it to "The Mysterious Future" here on /., but think about what this means if this is actually true. The potential vulnerabilities. All the trade secrets Microsoft put in there. Hell, IE 5 was released with Windows 2000, so if this is full source, it means IE 5 and the trident engine are in there as well.
If this is true, today may be the day that everything changes.
ReactOS have announced they have hit all upcoming milestones and consider their project "feature complete".
Sure it's illegal, but so have many things Microsoft has done.
I'm not sure that kind of justification really works. It also doesn't help the open source community, IMHO. I can't agree with the "let's sink to their level" philosophy.
Where law ends, tyranny begins -- William Pitt
Breaking News:
A member of the Slashdot cult has admitted he has stolen the source code to Microsoft's Windows XP operating system. PickyH3D is the handle the low-karma hacker used when bragging of his accomplishment to the world. He has also issued a challenge to Microsoft's legal team with the statement that "there is no evidence". More on this as we hear it.
Microsoft gave a talk at usenix: Windows A Software Engineering Odyssey
This slide indicates the full source is 50gb and took a week to setup and 2 hours a day to update.
That implies to me that people could have the whole source but it would huge.
Slide 24 talks about their new perforce based system that only takes 3 hours to setup and 5 minutes to update.
On the plus side, some of the comments are fairly humorous, especially when you note who wrote them and look up where they are today.
The Windows code hasn't had nearly as much peer review as open source OS's so I won't be suprised if this leads to a ton of exploits. The big problem here is that this source will be available to any black-hat that wants it--they obviously aren't going to be concerned about the legalities of obtaining leaked source code. But the businesses that use Windows aren't going to be able to audit the code for security leaks unless they obtain it illegally (or sign some agreements with Microsoft and shell out bundles of cash.)
For the same reasons that Microsoft warned its IE developers to stay clear of Mozilla, open source coders should avoid even seeing this.
That said, I'd love to get hold of the dll code that does the equivalent of a window manager in X. How cool would it be to swap out a dll on the Windows box at work and have a completely custom windowing environment?
The odds of getting one's hands on the full source to NT4/2K are slim to none--even most Microsoft folks couldn't do that.
This is incorrect.
Its funny how people build up ideas in their heads about what its like in a large corporation, somehow like a hollywood movie with lots of people with dark shades and guns ala "The Net".
No, inside Microsoft is a lot more like "Office Space" and anybody with motivation could get the entire source with little trouble.
Just to throw this out, what's the possibility that MS saw some similar routines in WINE and figured to shutdown the project by releasing some portions of the MS code that overlaps? They could essentially say that WINE must be based on MS proprietary code. Even with the code only publicly being leaked now, they could argue that copies may have been floating around for a while. Maybe they are taking some ideas from SCO on how to profit from the OSS community.
Just imagine the FUD/lawsuits/etc when, for some reason, Linux starts running on natively on NTFS.
100 GOSUB 7000 ; * Load stuff
110 GOSUB 900 ; * Show windows logo
120 GOSUB 20000 ; * Prompt for operator login
130 GOSUB 32000 ; * Fill half of memory with DLL's
140 GOSUB 16000 ; * Time waster loop
A feeling of having made the same mistake before: Deja Foobar
Imagine if somewhere hidden in the bowels of the Windows2000 source an intrepid SCO intern finds a sliver of SCO-owned Unix code. Then all hell would break loose...
As someone mentioned, this would be fascinating to just read the comments. Would it be possible for someone to strip out all the code, leaving only the comments for each file, minus comment lines that ARE code? It would be GREAT just to read the "intention" and "questions" living in that code and be able to associate each with a filename. Purely for entertainment value. It would also be neat to compare comment-to-code ratio in areas of MS code.
Ryan Fenton
I hope you weren't planning on ever contributing to any Open Source projects after doing that. If it's later demonstrated that you had access to the W2K source and contributed vaguely similar code (even by accident) to a project, it could have severe repercussions for that project.
... the textbook author would own all of your code.
... trivial code will generally be similiar regardless) the more difficult that is.
IANAL but I do read Groklaw, and from what I understand copyright restricts the act of copying (duplicating). You can study someone's implimentation of something as much as you like, then go impliment something similiar yourself. As long as you do not copy the code verbatim you are not in violation of copyright law.
Otherwise, no student would be able to code having once looked at examples in a text book
The problem is, of course, proving one implimented the code oneself and did not in fact crib the whole thing from someone elses code, and the greater the similiarity (for code of sufficient complexity
In any event, it is a myth that, simply by looking at, or even studying, one set of code one is somehow "tainted" and unable to contribute to another, competing project, be it free or proprietary. To violate copyright law one must copy, not just receive inspiration from.
The Future of Human Evolution: Autonomy
My question is, has anybody managed to get this steaming pile of manure to compile? Seems like one would need to do that and then compare the binaries (ignoring any timestamping) before assuming this is authentic.
"Freedom means freedom for everybody" -- Dick Cheney
The server is currently slashdotted, but I managed to download the first few lines of the Windows 2000 codebase. Here they are:
I was expecting the General Protection Fault License.
Libertarianism is rich wolves and poor sheep playing gambler's ruin for dinner.
You must either be new to Gentoo or new to Windows. It would most definately be:
ACCEPT_KEYWORDS="~x86" emerge win2000
I seem to remember reading that Microsoft gave China access to the entire source code, after the country mentioned that it was leaning more towards using Linux for government-related things, because the entire source code was open for inspection.
$ echo "ceci n'est pas une pipe" | sed -Ee 's/(eci n|pas )//g'
As long as you do not copy the code verbatim you are not in violation of copyright law.
Copying of nonliteral elements is actionable infringement. That's why many reverse engineering firms have two separate teams: one to describe a piece of copyrighted code and another to implement it.
In any event, it is a myth that, simply by looking at, or even studying, one set of code one is somehow "tainted" and unable to contribute to another, competing project, be it free or proprietary. To violate copyright law one must copy, not just receive inspiration from.
Try telling that to the estate of George Harrison, who lost in Bright Tunes v. Harrisongs. It's possible to copy without knowing you're copying, and it's still infringement.
WINEHQ: Early today, a developer who wished to remain anonymous contribued an astonishing amount of source code to the WINE project. Some initial testing performed by WINE core developers revealed that WINE's compatibility with Microsoft Windows applications releasted for Windows NT and Windows 2000 had perfect compatibility, even down to some annoying and well-known bugs that have plagued certain Microsoft DLLs distributed with Microsoft's operating systems.
;)
"This will really make it possible for non-Windows users to run more applications than ever using WINE on alternate operating systems like Linux," said one develper we spoke with.
I would be the most poetically ironic event ever if it turns out that it was a MS Win security hole that allowed a hacker to enter a server and steal the code.
Doubly ironic if it was a hole that MS has known about for months and not bothered to patch.
Triply ironic if someone finds said hole, patches it, and ships patched source back to MS.
__ Someday, but not this morning, I'll finally learn to use the preview button.
What about the opposite:
Is there GPL code there?
Ask an auditing company to
diff NT4 2000 | grep -e yourcode
and get an answer.
I don't think they're playing SCO if they released just a part of it maybe but not the whole thing
Blimey. We got wind of this around lunchtime GMT, and within half an hour two zip files mysteriously got downloaded to - ahem - servers some collegues and I have access to (no, I had no involvement in the download and have no idea of the source). We took a look, us being extremely sceptical of the claims, and ended up spending a few hours grepping the Win2K sources.
If this is a wind up, someone or people spent a long old time faking it. Microsoft notices and email addresses all over the place. They don't like the AIX compiler one little bit. Hardly any mention of Linux, GPL or GNU.
Actually quite a professional bunch of source files by all accounts. Appears to be using standard GNU Makefiles though. Yes, the 'f' word appears, as does the 's' word. Apparently Office 2k is broken in some respect that Win2k needed a tweak or some description.
Plenty of mentions of Internet Explorer, although I wouldn't like to say that we found 'IE' in the code, but then we aren't C experts at all. It does mention IE6 and Windows ME, so can't be all that old either. Does mention buffer overflows a fair bit, also plenty of 'hackhack' and 'bugbug' notes laying around.
In fact, nothing particularly spectacular found at all. We took a look, got bored, and went back to our normal work. Honest boss!
And no, we didn't try to compile it. We felt it was genuine enough though - not that we really cared. We did however note that if this lot is proven to be the real deal, Microsoft are going to be landed with one hell of a lot of security alerts for 2k/NT over the next six months.
Yours merely curious...
There have been articles on the web describing alot of their NT build process. They do use command line builds. They originally wrote a custom version control system, but now use something else (not Visual Source Safe, I think perforce, or perhaps they created anotehr system). I believe, if memory serves, that they had a custom make tool, but they may now use nmake, which is the make tool that's distributed with their commerical dev tools.
I recall the article did mention the use of perl for parts of the custom build scripts.
As a long time windows programmer, frankly, this stuff looks made up. Clever, amusing, but ultimately it seems like a hoax. If this is all the proof we have, then I'm afraid it's a bit pathetic!
Also there appear to be duplicate headers, repeated in various directories that I'm almost positive would end up screwing the compile process in a real build. Also, another thing is that, if their distributed files with VC6/7 are indicative of their internal naming, they stick to a strict 8.3 naming scheme, and make note of this in their documentation (don't remember *where* it was that I read it, but it was MS docs, and I remember being surprised by it). Another thing, again assuming that the files distributed with VC6/7 are a good model, their files tend to be all UPPERCASE! For example, here's a listing from their includes in for VC6:
-rwx------+ 1 Administ None 21912 Apr 24 1998 ACCCTRL.H
-rwx------+ 1 Administ None 27863 Apr 24 1998 ACLAPI.H
-rwx------+ 1 Administ None 3735 Apr 24 1998 ACLCLS.H
-rwx------+ 1 Administ None 747 Apr 24 1998 ACLSID.H
-rwx------+ 1 Administ None 269 Apr 24 1998 ACSMGTC.H
-rwx------+ 1 Administ None 267 Apr 24 1998 ACSSVCC.H
-rwx------+ 1 Administ None 833 Apr 24 1998 ACTIVECF.H
-rwx------+ 1 Administ None 1111 Apr 24 1998 ACTIVEDS.H
-rwx------+ 1 Administ None 39805 Apr 24 1998 ACTIVEX.MAK
-rwx------+ 1 Administ None 3794 Apr 24 1998 ACTIVEX.RCV
-rwx------+ 1 Administ None 2053 Apr 24 1998 ACTIVEX.VER
-rwx------+ 1 Administ None 68013 Apr 24 1998 ACTIVSCP.H
-rwx------+ 1 Administ None 17845 Apr 24 1998 ACTIVSCP.IDL
-rwx------+ 1 Administ None 3402 Apr 24 1998 ADDRLKUP.H
-rwx------+ 1 Administ None 18946 Apr 24 1998 ADMEX.H
-rwx------+ 1 Administ None 10051 Apr 24 1998 ADMINEXT.H
-rwx------+ 1 Administ None 2827 May 31 1998 ADOID.H
-rwx------+ 1 Administ None 343678 Jun 19 1998 ADOINT.H
-rwx------+ 1 Administ None 135222 Jun 2 1998 ADOMD.H
-rwx------+ 1 Administ None 14127 May 31 1998 ADOMD.IDL
-rwx------+ 1 Administ None 5083 Apr 24 1998 ADPTIF.H
-rwx------+ 1 Administ None 1133 Apr 24 1998 ADS.ODL
Don't worry... We're safe. MS can't prove what you're downloading, because no one there can open a tar.bz2!
TAR!? BZ2?! What the hell? That's not ZIP!!!!
A friend and his associate left a previous employer to form a start-up. They began work on a product, much like the one their former employer was developing. Though my friend largely contributed the code and many fixes to his associates code, the project died when the former employer had detectives raid the associates house. The former employer claimed they were copying the firmware, though my friend had mostly written it. However, an old code listing was found in his associates house after they had both vehemently denied copying any code from their former employer. In light of the discovery, the issue of stole-did not steal became a moot point, as they would need a company of lawyers, time and lots of money to defend themselves. If he had tossed all prior employer related junk from his home office, the burden would have been much greater on the former employer. Having some code at home which looked suspiciously like product code (particularly to the untrained eye) killed their start-up and put the associate in jail.
A feeling of having made the same mistake before: Deja Foobar
Worse still - if you work on any Open Source project, and you look at Microsoft Source code. . . DO NOT COPY IT!!!
We like Linux as it is. Reliable, stable, and fast. Copying Microsoft code in would jeopardize that. Never mind the IP issues. . .
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
This is probably old hat now, but....
Real men don't do backups, they just pack their files into windows_2000_source_code.zip and post them to their website.... with torrent links...
This leak is a shock not only to Neowin, but to the wider IT industry. The ramifications of this leak are far reaching and devastating. This reporter does not wish to be sensationalist, but the number of industries and critical systems that are based around these technologies that could be damaged by new exploits found in this source code is something that doesn't bare thinking about.
We ask that for the wider benefit of the IT community that members and readers support Microsoft by forwarding anything they know about the leak to the Microsoft's Anti-Piracy department.
Please do not post any links/screenshots/hints or anything to do with the source code outbreak. Discussion is allowed but we will not condone people spreading this source code.
(The rest is just the comments, you know, crap like you get on /.)
But, it only takes one person to look at the Windows source, then go do something vaguely similar in Linux (or any OSS project for that matter). The result would be devastating: Microsoft would litigate Linux to death.
As many have said, the principle behind these copyright suits is awful. Looking at code, then doing something somewhat similar (because of inspiration) should not be a copyright violation. But with Microsoft's legal and financial resources, the laws will "adapt" to what is most beneficial to them.
I can only echo what many other have said: for the sake of Linux and OSS in general, do not look at the Windows source!. That's a very conservative and overly-paranoid policy, but it's a invaluable measure for protection.
To me, general acceptance of open-source software is similar to political elections: every last spec of dirt is drug out and put under the spotlight. Any potential or suspect or even misunderstood characteristic is scrutinized, and the naysayers always manage to put a negative spin on it.
Open source only stands a chance if it can maintain the straight and narrow path... I hate to sound preachy, but any slight mishap, no matter how innocent or accidental, quickly turns into a major catastrophic disaster. There's just too much money and power interested in seeing OSS fail.
If code is made criminal, only criminals will have the code
Now that was a very satisfying cliche re-use. I hope it was an original cliche re-use.
BTW the server seems ve-wy slow to-day. I think we were just Farked.
"Will future ages believe that such stupid bigotry ever existed!" -- Ivanhoe
This is an attempt to corrupt your ability to write reliable code. It is the software equivalent of a Medusa. Once you've looked at it your mind will be agog to make blue screens. Do not look! For the love of Pete, DO NOT LOOK!!!!!
It's 5:15PM. I got home from work 2 hours ago, and had a nap. It is a beautiful day outside, and the Windows source code has been leaked.
And I have 5 Moderator points.
Today -- today, life is good.
I find this one refreshing...
/* You will be assimilated, suckers */
if (app.exename="NETSCAPE.EXE") system.sluggify();
And this one provides for the future...
if (site.url="www.google.com") {
browser.renderer.togglebuggyrenderer();
browser.fakepopup("www.msn.com");
}
I can't say anything about this one though:
if (user.status==PISSED_OFF)
prick.annoyingpopup("Hello, I noticed you are writing a letter")
Seriously, given the denounces of delayed APIs for Navigator, I wouldn't doubt the first one... could someone with the codes please grep for netscape.exe?
To note if the leak is true and the stock gets pounded it's unlikely one would get the opportunity to short the stock. Ref SEC rule 10a-1 (aka "Uptick Rule). For Reference: http://www.forbes.com/2001/10/04/1004short.html But bottom fishing would certainly be in order. Question of course is where is the bottom when a stock takes a hit? :)
Cheers!
IAAL.
/.! You must be just some miserable karma whore... or then you just made a major typo and forgot the obligatory "N" and ",but".
My god, this is simply not possible - man, this is
Well, I believe the latter must be the case. Be more careful on your next post, OK?
“Wait for Hurd if you want something real” –Linus
...I hear the source code to Linux gets leaked every other day!
...when hackers broke into Microsoft's corporate network. Google is your friend.
I worked at MS on NT, and though it's been a few years, I can definately tell you there are "gnumakefile" files all over the place. It's the first thing any coder notices when they first look at the source, "Hey theres a Makefile, and a gnumakefile, what's the deal?"
If you'd really seen the source, you would have remembered that.
found a torrent: ed2k://|file|windows_2000_source_code.zip.torrent| 16496|5506C49CCCA12204BAB6FE960CE5602C|/
n fo 20021207 - decode BitTorrent metainfo files
btshowmetainfo.py windows_2000_source_code.zip.torrent
btshowmetai
metainfo file.: windows_2000_source_code.zip.torrent
info hash.....: f03fc1e04869294d5644d3c8c5d0fb8f2d26aa59
file name.....: windows_2000_source_code.zip
file size.....: 213748207 (815 * 262144 + 100847)
announce url..: http://alge.nlc.no:6969/announce
maybe its that thing, atm 23 seeders, 239 downloading and it was created on 2/12/2004 11:16:13 PM, so looks good so far
knock yourself out
100% compatibility with all Windows programs.
"Don't ask us how we did it!!!"
Because Microsoft doesn't accept code updates from people who know better than they, so any bugs that are revealed are not going to be fixed through the increased visibility of the code. Having open code is only good if you have the will, the ability, and the infrastructure to make use of its openness. Microsoft is famous (infamous?) for lacking all three.
The short of it is: no "free" security updates a la linux, just more visible bugs to exploit.
I should not talk so much about myself if there were anybody else whom I knew as well. -Henry David Thoreau
A)
1. look at the linux source
2. find a mistake
3. send a patch to the maintainer.
4. PROFIT!!
B)
1. look at the windows source
2. find a mistake
3. ???
4. write a worm
5. get caught
6. JAIL=tEH_SuXX0rZZ!!!1!! lolomgrofl
Free as in mason.
This is extremely good advice. I would go even further and say that if you would ever like to work on an open source project, don't look. The presence on a project of a person who had seen the Windows source could put the entire project at risk.
For a very practical example, consider Samba. If a person who had seen the Windows source were to contribute to Samba and it were later to come to light that the contributor had seen the Windows source, in the name of safety every piece of code that person contributed would have to be ripped out and replaced. Worse, to guarantee that there was no trace of taint, it would probably have to be replaced by people who had not only never been exposed to the Windows source, but who had also not seen the contributor's tainted code. In short, it would require the recruitment of people who had never worked on the project before, or even read the source. Finding those people would not be easy, to say nothing of the time and credibility that would be lost.
For that matter, even if you have legally seen the Windows source because Microsoft has provided it to your employer under their shared source program, the same taint would follow you. If your employer has access to Windows source and your job does not require you to see that source, do yourself a favor: don't look.
If you look at the Windows source, you at the least taint yourself WRT working on any project aimed at interoperability with Windows, and quite possibly on a much wider variety of projects than that.
In short, JUST SAY NO.
The listing appears valid, but is only a subset.
I lived for years with full source access at a MS partner company.
Example of what's missing is the file systems (only the file system recognizers seem to be there, not the file system), the entire device driver tree, storage drivers, etc. Most of the core kernel functionality is there though, if pre-service pack levels.
Because Microsoft never had its code freely audited. Because they won't take patches from Joe Shmo. Because they design for features first, security third. Because they relied on security through obsurity. Because they don't have a global network of developer-users to fix patches when they see them. Because it takes Microsoft a relatively long time to fix bugs. Because...
Why, o why must the sky fall when I've learned to fly?
http://www.internetnews.com/ent-news/article.php/3 312451
r ol eak_1.html
. as p
http://zdnet.com.com/2100-1104_2-5158496.html
http://www.infoworld.com/article/04/02/12/HNmic
http://www.eweek.com/article2/0,4149,1526390,00
Why this is perceived as such a security threat to Microsoft, when it's not for Linux?
Because Microsoft's OS was, and is, designed and developed based on a principle of closed source. Generally speaking, with closed source development potential black hats can't see how you do things without significant reverse engineering. This gives the OS programmers a 'safe' framework to work within. So when that source later becomes available to the general public, it leaves the OS programmers facing a huge legacy of problems that should, in theory, never have become problems.
Linux was open source from the outset. Therefore it is designed and developed relying absolutely on the principle that it's secure because everyone has equal access to see how things are done.
Furthermore, if and when there are security holes then at least with OSS you can never be held to ransom by the people owning the source. i.e. "Windows 98 has this huge security hole and it's no longer supported - go buy Win2k."
by a 500LB gorilla.
It has nothing to do with morals. It's self preservation.
Most companies don't have the resources to kick the crap out of warez distributors. MS isn't one of those companies.
Ben
Work Safe Porn
I think you people are going a little overboard. Windows source code isn't like a virus or something.
Wait a minute....
http://www.sschmidt.info/w2k_source.torrent
:-)
I haven't finished downloading this, but it's 200MB in size, has 944 peers!
The tracker is the same one you have listed:
http://alge.nlc.no:6969/announce
The hash is also the same.
its in the wild and no one can do anything about it.
most ppl are downloading it to have something to brag about. others are just peeking at it for the fun of it, like me. just a few grep's showed some interesting things...
the file actually is the zip to the spreading files.txt
whats a little bit weird is a linux coredump at private/security/msv_sspi/core
it appears someone named eyala from mainsoft used vim (VIM - Vi IMproved 5.6 (2000 Jan 16, compiled Mar 7 2000 12:18:07)) on a redhat x86 box under xfree86/kde on a w2k sp1 sourcefile, well until the box ran out of memory...
The company was actually called Spider, and the Spider TCP/IP stack (which was BSD-derived) was used in exactly one MS operating system: Windows NT 3.1 (1993-1994).
Windows NT 3.1 was released in 1993, and replaced in 1994 by Windows NT 3.5, which was much smaller, much faster and used an MS-written TCP/IP stack (which was presumably smaller and faster than the BSD-derived Spider stack). The MS TCP/IP stack in NT 3.5 was then ported to Win9x for the release of Windows 95.
The lifetime of NT 3.1 was very brief, and during that brief lifetime, hardly anyone used it (because it was too big, too slow and there was no Win32 software), so the fact that its TCP/IP stack was BSD-derived is not really something to brag about.
Guys...
I can't believe you haven't figured out what the EML files are yet.
Anyone remember NIMDA? The worm from 2002 I think? It had this exact same effect of sticking infected eml files all over your folders (by taking some names from your files, and others randomly). Opening those EML files or forwarding them would guarantee future and constant infection.
It's clearly evident that this machine was infected by nimda and got port-scanned and found. The rest of the code is probably going to come soon enough, unless MS already found out and pulled the plug.
By the way, alpha doesn't mean "Alpha Version" but the Alpha CPU made by DEC, now owned by Compaq.
IT WAS LIBERATED!!!!!!
The "Insert Quote Here" line is almost as predictable as inserting an actual quote.
I read rotten.com, I think I'm about as fscking tainted as they come. It's absurd to think that there would be ground for a lawsuit against an open source project you worked on because you had at one point glossed over the NT kernel source or something. That's like homeopathics who believe that remedies should contain miniscule quantities of active ingredients. In fact, the "strongest" formulations usually contain not a single molecule of the substances in question. Zero parts per billion -- pure water.
I've seen the Windows CE source. Maybe I should never program again because MS could sue me! I think not.
PS No offence to homeopathics, I don't care what crazy shite you belive in.
-73, de n1ywb
www.n1ywb.com
We have identified over one million lines of our IP in Microsoft's source code. While I cannot share most of them because they are a trade secret, here are three of the most glaring examples:
#include
for( ; ; )
if(!stop) {
Many of these lines have been copied verbatim several thousand times. We do not want to, but are forced to sue Microsoft for unlicensed use of our intellectual property.
We will institute a licensing program called gplSource which will allow Windows users to obtain the legal rights to use our IP. This cost will be significantly discounted to early adopters.
Already at least three Fortune 500 companies have seen the validity of our claims and have paid these fees on a per-CPU basis to continue using Windows. While we cannot divulge their names, they do exist. Really!
Computer Science is no more about computers than astronomy is about telescopes. --E. W. Dijkstra
Think it absurd if you want; the law certainly allows for it. It works like this:
1) You see some proprietary source, either legally or otherwise;
2) You later work on some open source project;
3) The copyright holder of the proprietary source in 1) looks at the open source project and decides that some sections of the code look strikingly similar to their own code. They further discover that you wrote or contributed to those sections. They call their lawyer. Now, it may well be a combination of "coincidence plus a limited number of ways to do X" that caused the similarity, but you're going to have to convince a judge and/or jury of that. The other side will have to convince them that you copied it. They've got the striking similarity plus the fact that you've seen their source. What have you got?
Now, since you've seen the Windows CE source, why don't you ask the Samba project if you can join, and tell them you've seen MS source code (whether legally or not doesn't matter; seeing it is all that matters) and see if they will take you on as a developer.
I bet they won't.
MS's game department isn't what brings in all the money. It's their Windows and Office products that make the money.
They can grin a bear it when some games are pirated. Why do you think they (try to) crush companies that make mod chips for the XBox? Some things are more important.
And this is the source code to Windows. This is NOT just another product.
Anyone who dares to host it will be sat on until they are dead. Hell hath no fury.
Claiming this is just another product shows your definit lack of ability to comprehend the scope of this leak and the importance of it to MS's bottom line.
The legal costs required to shut down warez sites over a game generally are more than the amount of the losses. The legal costs required to crush the fools who dare to host the Windows source comes nowhere near the potential losses due to the leak.
Ben
Work Safe Porn
Microsoft Confirms Windows Code Leak
---
Microsoft Corp. on Thursday confirmed that the source code for two versions of its Windows operating system has been leaked, a security breach that could give hackers important intelligence about how to exploit flaws in software run by most of the world's computers.
"Today we became aware that incomplete portions of Windows 2000 and NT 4.0 source code was illegally made available on the Internet," said Microsoft spokesman Tom Pilla. "It's illegal for third parties to post Microsoft source code and we take that activity very seriously."
Pilla said the company does not know how much of the operating system code was compromised, but he said Microsoft believes it was not a complete version of either operating system.
There was no indication that the code was stolen through a breach of Microsoft's internal network, Pilla said. He said the FBI is investigating the matter.
Computer security experts said the release of Windows source code could pose a significant threat to Internet security, depending on what portion of the code was leaked.
A leak of any portion of the Windows code "could dramatically increase the probability that new zero-day vulnerabilities will be found," said Alan Paller, director of research the SANS Institute, a security training group based in Bethesda, Md.
"Zero day" exploits are highly effective attacks that occur when hackers discover a way to exploit a security vulnerability before or at the same time as a software maker learns of the flaw. Attackers can then use this information to launch a virus or worm that exploits the security hole before a patch can be released to fix the problem.
Thor Larholm, senior security researcher at Newport Beach, Calif.-based PivX Solutions, said the Windows source code file being traded on the Internet appears to be roughly 660 megabytes in size, about the size of one CD-ROM's worth of data. That is far short of the estimated 40 gigabytes of data that makes up the entire 40 million lines of code in the Windows operating system.
Even a partial leak "is a potentially very serious problem for Microsoft," Larholm said. "Just look at the vulnerabilities that are discovered by people who didn't have access to the source code."
The origin of the leak is not currently known. The Redmond, Wash.-based software giant closely guards the computer code that comprises the company's operating system. But Microsoft does license portions of its programming code to security researchers and more than 50 universities under its "Shared Source Initiative."
Microsoft last year said it would began sharing complete copies of its source code with governments around the world that want to validate the security of the software before deploying it in national defense and other sensitive areas. Microsoft signed an agreement in 2003 that lets the Australian government inspect the source code of Windows 2000, Windows XP and Windows Server 2003. Other counties, including India, are exploring similar arrangements.
Unlike open-source software like the widely used Linux operating system, the code comprising Microsoft's Windows software is not open for public inspection. Linux users are encouraged to participate in an open, continuous cycle of modifications and upgrades that its proponents say results in systems that are more secure and reliable than those powered by proprietary code like Windows.
Yeah, there are a few trivial and ancient/obsolete BSD command-line tools in Windows (finger, ftp, nslookup, rcp, rsh). They were ported from BSD, and you can see that they contain the appropriate copyright attribution. Note that none of the kernel-mode files (e.g. the TCP/IP drivers) contain any such strings.
MS is naturally not opposed to using freely-available BSD code to achieve better interoperability with BSD/UNIX. MS Windows Services for UNIX, for example, includes a lot of modern BSD tools ported from OpenBSD. That's reasonable, of course, since it's supposed to provide a set of command-line tools familiar to UNIX systems administrators, and OpenBSD tools are known to be relatively good in terms of security.
Importantly, MS's porting of OpenBSD userland tools to Services for UNIX is also good for OpenBSD, because it helps to establish those tools as something of a standard. If hordes of MS users become used to the OpenBSD userland tools, they'll be much likelier to start using OpenBSD if they want a UNIX-like OS than to start using, say, Linux.
The common claim about the MS TCP/IP stack from open source zealots is that MS 'stole' the Windows TCP/IP stack from BSD because it couldn't write one of its own, which is of course complete nonsense. The handful of BSD tools in Windows are/were there to make it easier for UNIX users to access their systems from Windows. They're in no way critical to Windows as an operating system (in the way that, for example, a TCP/IP stack is).
Hmm. That's my tracker. And it's dead now. I probably should learn to not have a public tracker.. *sigh*
Anyway, at least 1000 people got it down, so it shouldn't be too hard for some of them to make a new torrent. But I'm definetly not going to host it anymore.
--
alge of flauna
http://alge.nlc.no/
$ grep -r -i fuck *x :fucks?sMxl impse_index:fucking?sMjl come/html/webapp.cpp: // HighContrast mode is turned on. This totally fucks our style sheet as most of it will/ shell/windbgrm .c: // The user fucked uph : * !!!!!!!!!!!!!!DOING SO FUCKS THE BUILD PROCESS!!!!!!!!!!!!!!!!n trol/midi/map.c: // !!!this is fucked if a map goes to multiple physical devices
bsc/.glimpse_index:fuck?sMP
bsc/.glimpse_inde
bsc/.glimpse_index:fucked?sM`
bsc/.g
private/shell/applets/we
private/shell/shell32/copy.c:// want to fuck with.
private/shell/shell32/util.cpp:// the fucking alpha cpp compiler seems to fuck up the goddam type "LPITEMIDLIST", so to work
private/shell/shell32/util.cpp:// around the fucking peice of shit compiler we pass the last param as an void *instead of a LPITEMIDLIST
private/shell/shell32/util.h:// the fucking alpha cpp compiler seems to fuck up the goddam type "LPITEMIDLIST", so to work
private/shell/shell32/util.h:// around the fucking peice of shit compiler we pass the last param as an LPVOID instead of a LPITEMIDLIST
private/windbg64/debugger/tl/remote
private/windows/media/avi/verinfo.16/verinfo.
private/windows/shell/co
Security bugs.. Nah...
_ 01.html
ORGANIZATION=Mainsoft Co. Ltd.
MAINSOFTLM_HOST=@xora /app-defaults
$ grep -r strcpy -i . | wc
10454 42054 1069145
Where it was ganked from:
There is a core dump file inside the windows 2000 (sp1) archive, it clearly shows that the source was stolen from a system at Mainsoft. The following url confirms that they did have access to the leaked code. http://mainsoft.com/news/press_releases/2000_3_22
The actual strings which confirm this:
PWD=/usr/ms/win2k_sp1/private/security/msv_sspi
DOMAIN=mainsoft.com
REPLYTO=eyala@mainsoft.com
MWBATCH_SERVER=lod:8000
MSOFTLM_HOST=@xor
XAPPLRESDIR=/il2/users/eyal
EDITOR=vi
BASE_LIBPATH=/usr/lib
I'm submitting patches to the 2.6 kernel for the blue screen of death. I'm hoping they make it in to the next release.
http://torrent.spyderlake.com/download.php?info_ha sh=f03fc1e04869294d5644d3c8c5d0fb8f2d26aa59
4667 *.c files. 5601 *.h files. 2255 *.cpp files. 26 *.hpp files. 1456 *.cxx files. 961 *.hxx files. 148
Lines of code:Some grepping..Bugs anyone?Curious; grepping for 'linux':'grep -r -i's with no results: GNU/Linux, GNU GPL. Bill Gates, Steve Ballmer,
The Reuter's article on Yahoo contains a number of inaccuracies that are clearly prejudicial, and are probably sourced within Microsoft.
It (the story) amounts to an obvious attempt to spin up a scenario that will lead ultimately to criminal prosectution of persons involved in Open Source. And the story being such an obvious attempt at spin doctoring could lead one to believe there is more going on here than one poorly written news story...
Apparently Gates & Co. have decided their civil case fronted by SCO is not quite strong enough, and are trying to establish criminal precedent in order that, whether the current SCO effort succeeds or fails, the next case will be criminal.
One could hope that the courts will develop enough tech skillz to determine that the line
showing up in both windoze and Linux code does not constitute proof of theft under some Gatesien system of jurisprudence ...
Examples of the (imo) prejudicial language in the story [emphasis mine]:
There is no evidence cited that the code is being "traded". It appears that it is being distributed, but I haven't seen any reports of it being exchanged for anything else. This is key, since the languaged used here implies a profit motive on the part of the alleged "traders"; necesary for the criminal prosectution because there is a need to establish that the code is worth a great deal...
This sounds like it came straight out of a Microsoft publicist. It is an emotional appeal statement, designed to imply a henious threat to the alleged victim, Microsoft (and by implication, SCO).
The statement is factually inaccurate, even as metaphore. Source code is a principle part of the products manufactured by most software companies, but expertise in the creation of source code is more properly the "lifeblood" of the company.
Of course, Microsoft is a bit challenged in the expertise dept, but that should be applied to "any software company"....
If it is indeed "illegal" for 3rd parties to post the sources, then why would the aforementioned "agreements" require threat of civil action? If it's illegal, there should be no need to lititgate. The threats would be of prosecution, not litigation.
Furthermore, the word "share" here is ridiculous. If you've ever looked at what it takes to get an NDA to look at M$ sources, there's no "sharing" to it. It's a business transaction, and it doesn't happen unless M$ gets the lions "share" of any potential benefit.
WTF? Well, admittedly I haven't written any "programs running on Windows" in quite a few years, but I no idea things had changed quite that much... [that's sarcasm in case you can't tell; the statement is just plain wrong]
"The Internet is made of cats."