Slashdot Mirror
FBI on the Windows Source Code Theft
Chris Gondek writes "There are various articles about the Stolen Windows Source Code, but today it is confirmed that an FBI task force hunted for a cyber-criminal who posted on the internet source code for Windows which says 'I can confirm that the Northwest Cybercrime Task Force was investigating, FBI spokeswoman Robbie Burroughs said. The posted program is part of the source codes, or blueprints, for Windows 2000 and Windows NT 4.0, according to the company.' "
Can they track torrents? Not that I'm afraid of the Fumbling Bumbling Idiots or anything...
There will be a scapegoat regardless if they find the real criminal or not. After all, Microsoft wants to ease the minds of consumers and investors.
Life is not for the lazy.
The FBI really needs to crack down on this whole Internet thing before the terrorists get their hands on that source code. Good to see they're doing something about it.
In any case, Microsoft's code allows the company to keep its near-monopoly on computer operating systems, for the same reason Coca-Cola guards its secret formula.
Yes, It's very lucky that there is absolutely no way to obtain any MS source code!
Unpretentious Sydney reviews by unqualified Sydney reviewers
Anyone that's a peer in the torrent has your IP address. All they have to do is connect to the torrent and start collecting IP addresses of any peer that sends a piece of the file.
The article says FBI spokesperson said 'It's illegal to download it.'. How can that be? Is it really so? What if your girlfriend downloads a file called 'cookingrecipes.zip' and it happens to contain stuff she did not know - such as Windows source code? Does that mean innocent downloaders can be put in jail?
Why would the FBI care unless the source code had all the secret gov't backdoors plainly visible? :)
Chris
You'd think the FBI had some sort of pro-corporate bias!
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
It was only about 5% of the source that got released so we'll only see about 20 backdoors.
REWARD
Have you seen this code:
MOV AH,09h
Believed to be part of a larger gang of code, this fragment is guilty of initialising a register for potentially illegal or disruptive purposes, notably the dissemination of disturbing messages or misinformation. Older intelligence indicates that the code was often seen accompanied by its partner:
INT 21h
But now believed to be part of a larger organisation.
AT&ROFLMAO
I haven't had many problems with it.
Maybe you are over reacting.
Not that I condone this
Nothing in the world is more dangerous than sincere ignorance and conscientious stupidity.
It's a perfect metaphor. Computers don't run C code, just as we don't live in drawings of houses. Both are human-readable representations that we can use to build the implementation.
MSHTML.dll for those that don't know is the heart of Internet Explorer , (iexplore.exe is just a wrapper for mshtml) prepare for some exciting browser exploits , Winsock should ensure there is plenty of fun to be had with windows networking sockets
and don't forget MSPaint was in the source tree so Adobe had better watch out
What went wrong with the US law system? Microsoft is finally in compliance with their anti-trust regulations, opening up API's and stuff, and now the FBI is investigating that? ;-)
my other sig is a 500 page novel
After reading the article, I can only say it's pure PR speak, factually error prone, and more than a bit slanted. Perhaps this paragraph explains the timing:
"The announcement of the leak came on the same day Microsoft pushed in Washington for tougher anti-counterfeit legislation in the United States and worldwide, saying pervasive pirating of computer software was hurting the industry."
Given that any number of companies and computer professionals have access to Windows source for various reasons, it's not unreasonable to think that occasionally chunks of it appear in the wild.
And certainly a lack of source code hasn't slowed down the virus and worm industry.
Consequently I have to assume that this story is just a way for Microsoft to build support for even more draconian anti-piracy and DRM laws.
As a post-script - the original post and magazine link should be modded +5 funny at best. It's really quite pathetic.
Three Squirrels
Among other things, the zip contains the source code to Notepad (you always wanted that!) along with an intriguing bugcodes.txt file that explains a lot of bluescreen/stop errors in more detail than you'll find anywhere else.
G Kv54~o6A
E MG Kv54~o6A/windows_2000_source_code.zip
File: windows_2000_source_code.zip
Key: CHK@JANQuMJMYGNWPVWyfwBwyXPsgBwPAwI,LeWue01uUKoEM
Bytes: 213748207
CHK@JANQuMJMYGNWPVWyfwBwyXPsgBwPAwI,LeWue01uUKo
Of course if you don't have Freenet yet (what are you waiting for?) you'd do good to visit http://www.freenetproject.org.
What and ruin another pedantic rant with facts? Never.
Counterfeiters don't want the source code, they just copy the binaries and maybe a hack to circumvent registration.
"Computer activists" even less so -- copying Windows code would poison any GPL project.
In any case, Microsoft's code allows the company to keep its near-monopoly on computer operating systems, for the same reason Coca-Cola guards its secret formula.
True; but the reason Coke and MS have near monopolies is because of marketing, not innate superiority of their products (Pepsi wins most blind taste tests; Macs win all usability tests).
In parts of Asia and the former Soviet Union piracy rates approach 90 per cent, they said. As a result, the US software industry loses $US13 billion ($A16.52 billion) a year for counterfeiting and other forms of software piracy.
Debatable; but irrelevant anyway.
The US Congress is considering legislation designed to close a number of legal loopholes often allowing counterfeiters to get away with their activities, specifically prohibiting trafficking in genuine authentication components.
Again, the idea that this will make piracy more prevalent -- it will have no affect at all on MS warez.
--CTH
--Got Lists? | Top 95 Star Wars Line
It amazes me just how much emphasis is placed on financial losses due to piracy. Just because people are using pirated versions of software does not mean they would have bought it anyway! The figure qouted is a "best case scenario" projection of what could have been new sales, but the companies are not actually losing that amount from money they have already earned.
'SBEMAIL!' is better than a goat!!
The leak of the code scares the shit out of me. We've had some rather nasty security bits on the net lately and this is not a reassuring development.
will increase the time I have to spend securing my system. although true, my main target in such a suit would MS itself for (1) not securing the code properly (2) recent stories (and past ones) of them sitting on security patches for months on end.
If someone broke into my house and I followed my handbook and best practice about securing my house and it was STILL penetrated I want to go after the security document, not the intruder (the intruder would be handled by the criminal courts, my case is civil and monetary in nature since everytime some BS exploit is released and MS hasn't a patch my company is spending money to monitor and sort things out.
Vary rarely will you see a class-action suit against an individual (I can't recall one, just ones against companies when their neglegence is going to lead to a large cash settlement..... I wonder how the MS lobbyest have protected them from such action)
If MS corporate net was really compromised, like BBC reported, the leaker should have posted it on download.microsoft.com.
If it were posted there ( like in DirectX9.1.zip or somesuch ), would they still have legal grounds to hassle the users who downloaded it ?
http://validator.w3.org/check?uri=http%3A%2F%2Fwww.slashdot.org Errors found while checking this document as HTML5!
"Technically, you could call source code blueprints."
Technically, only if you printed it. In blue.
Interesting. From this, one must conclude that either (a) Microsoft legitimately releases the code to others outside these two programs, but we don't know about it; (b) Microsoft has absolutely no idea how the source was released but is lying through its teeth claiming there was no security breach nor an unauthorized release from its shared source programs; (c) Microsoft leaked the code itself for nefarious purposes (e.g. destroying ReactOS).
We report, you decide.
You're quite right - but there is a difference...
Let's use the home metaphor - you live in a house in a neighbourhood built by "MS Homes". They are nice, comfortable homes, but the security system involves closing your front door with a plastic latch. Because the latch doesn't LOOK like plastic, everyone feels secure. Burglars, however, suspect there is an easy way in to the homes.
Now, if none of the good guys examine the security and say, "Hey, maybe these latches should be steel", then eventually a bad guy will figure it out and your home is open for business.
In such an event, if a good guy opened *a* front door on a *single* MS home, then posted a note in the local newpaper that maybe latches should be upgraded, I'd sleep with a shotgun until my latch was replaced. In the end, I'd have a safer home and know it. Without the good guy, I don't have a safe home, AND I'm unaware until a break in.
Unless you use something like Freenet to download.
But even there they can see your IP. There just is no way to prove it was you that did the request, or was just 'forwarding' the request thru your node....
---- Booth was a patriot ----
Open Source code is available for everyone. Only criminals can use the Windows code.
Programming can be fun again. Film at 11.
cough... cough... FUD...
:) and read the email they sent him. The email was sent from Microsoft, not from the FBI or any law enforcement entity.
I spoke with a gent on the same network reporting the same experience (could be the same guy
It's not FUD. The gent in question also mentioned that his torrent download jumped from about 100K/s to 600K/s at some point through the download, which would lead me to believe that somebody with fat pipes *cough*Microsoft*cough* jumped into the swarm, likely in order to start tracing IP addresses.
I do wonder a bit about that, however, because if Microsoft jumps into the torrent to start nabbing IP's, haven't they also contributed to the dissemination of the source code by participating in its distribution? I'd imagine that it's no more of a problem for them legally than it is to undercover police selling drugs in sting operations. I do wonder if it should be, however...especially considering that they're *not* a law enforcement agency.
Dan
According to BetaNews, a company called Mainsoft is to blame. They allege that Mainsoft had access to the code in order to develop their Visual MainWin tool giving developers the ability to write Linux and Unix apps from within Visual Studio.
There's no need to seed or download a torrent to get IPs from the tracker, it's totally separate. A normal BT client will get IPs from the tracker, and provide its own IP, then use that information to make connections and start downloading and uploading. It is trivial to connect to the tracker and ask it for the IP of everybody currently on that torrent, along with their status (seeding, downloading, how much progress). This is why using BT for illegal activity is extremely boneheaded. I doubt if the speed jump was related to MS's tracking, unless they were being stupid.
Mod down posts with a "Free Mac Mini/iPod" sig, they're spam!
I said it before and I'll say it again: the globalization MUST be improved. If they want investigations across the borders - they have to remove the borders. That include the freedom to trade across the borders, the freedom to hire across the borders, the freedom to ELECT across the borders, the freedom to immigrate across the borders.
You don't wanna give that freedom to people? Enjoy your useless attempts to sue DVD hackers in Norvey and find IP addresses in Russia.
Remember: there is no such thing as "half of globalization". It either exists givig equal opportunities and freedoms to everyone, or it doesn't exist at all.
Less is more !
you may receive a letter like the one below if you pull the file off of edonkey (Windows.source.code.w2k...). this is kind of ironic, because the file downloadeed was a fake.
> Hash: SHA1
>
> J.K. Weston
> Microsoft Corporation
> One Microsoft Way
> Redmond, WA 98052
> jkweston@microsoft.com
> Tel: (425) 703-5529
>
>
>
> URGENT/IMMEDIATE ATTENTION REQUIRED
> VIA ELECTRONIC MAIL
>
> Re: NOTICE OF POTENTIAL UNLAWFUL DISTRIBUTION OF MICROSOFT SOURCE CODE AT:
> xx.xx.xx.xx
> Date of Infringement: Detail below.
>
> Dear xxxxxxxxxx:
>
> We have received information that one of your users as identified above by
> the SITE/URL xxxxxxxxx may have engaged in the unlawful distribution
> of Microsoft's source code for Windows 2000, and/or Windows NT4, by
> distributing and offering for download these source code files via a
> peer-to-peer network.
>
> Since you own this IP address, we request that you take appropriate action
> against the account holder under your Abuse Policy/Terms of Service
> Agreement.
>
> We also kindly request that you forward this notice promptly to the user
> of the IP address listed above at the time and date stated.
>
>
>
> To the user at xx.xx.xx.xx:
>
> The unauthorized copying and distribution of Microsoft's protected source
> code is a violation of both civil and criminal copyright and trade secret
> laws. If you have downloaded and are making the source code available for
> downloading by others, you are violating Microsoft's rights, and could be
> subject to severe civil and criminal penalties.
>
> Microsoft demands that you immediately (1) cease making Microsoft's source
> code available or otherwise distributing it, (2) destroy any and all
> copies you may have in your possession, and (3) provide us any and all
> information about how you came into possession of this code.
>
> Microsoft takes these issues very seriously, and will pursue legal action
> against individuals who take part in the proliferation of it source code.
> We look forward to your prompt cooperation. Should you need to contact
> me, I can be reached at the address above or at jkweston@microsoft.com.
>
> Very truly yours,
> By
> J.K. Weston
Granted, we have so much riding on Windows that it being compromised is akin to loosing a national secret, but who is to blame here? If we lean so much on MS's code being secure, why are people storing data on there that could be a probem if the system was hacked?
--pete
Yeah, but you can over analyze the media. Usually it's less than worthless.
h es _quote03.html
Check this out:
http://www.crichton-official.com/speeches/speec
Media carries with it a credibility that is totally undeserved. You have all experienced this, in what I call the Murray Gell-Mann Amnesia effect. (I refer to it by this name because I once discussed it with Murray Gell-Mann, and by dropping a famous name I imply greater importance to myself, and to the effect, than it would otherwise have.)
Briefly stated, the Gell-Mann Amnesia effect is as follows. You open the newspaper to an article on some subject you know well. In Murray's case, physics. In mine, show business. You read the article and see the journalist has absolutely no understanding of either the facts or the issues. Often, the article is so wrong it actually presents the story backward--reversing cause and effect. I call these the "wet streets cause rain" stories. Paper's full of them.
In any case, you read with exasperation or amusement the multiple errors in a story, and then turn the page to national or international affairs, and read as if the rest of the newspaper was somehow more accurate about Palestine than the baloney you just read. You turn the page, and forget what you know.
That is the Gell-Mann Amnesia effect. I'd point out it does not operate in other arenas of life. In ordinary life, if somebody consistently exaggerates or lies to you, you soon discount everything they say. In court, there is the legal doctrine of falsus in uno, falsus in omnibus, which means untruthful in one part, untruthful in all. But when it comes to the media, we believe against evidence that it is probably worth our time to read other parts of the paper. When, in fact, it almost certainly isn't. The only possible explanation for our behavior is amnesia.
why it takes less than six days for M$ to be hot-n-heavy on the trail of the source of the leak while it takes M$ six months to patch a serious security vulnerability in their source code?
Eternity: will that be smoking, or non-smoking? I Corinthians 6:9-10