Slashdot Mirror
VMware Confirms Source Code Leak
Gunkerty Jeb writes "Purloined data and documents, including source code belonging to the U.S. software firm VMWare, continue to bubble up from the networks of a variety of compromised Chinese firms, according to 'Hardcore Charlie,' an anonymous hacker who has claimed responsibility for the hacks. In a statement on the VMWare Web site, Ian Mulholland, Director of VMWare's Security Response Center, said the company acknowledged that a source code file for its ESX product had been leaked online. In a phone interview, Mulholland told Threatpost the company was monitoring the situation and conducting an investigation into the incident."
Hmm, I wonder where the hackers are based, and if it is state sponsored. Software code is the bet industrial espionage, because you can re-implement it yourself. My prediction - keep an eye onn the market to see who's the first to release a VMware clone!
Talk about burying the lead!
This VMware source code reportedly was stolen from Chinese military contractor CEIEC, the China National Electronics Import-Export Corporation. VMware code wasn't the only target.
What was the the Chinese military contractor doing with the VMWare source code anyway? And what other software packages were affected?
Hackers hack, that's what they do. But Chinese military contractors with VMWare source code in hand seems a much bigger story if you ask me. Did they have a license to it? Can anyone get a license to it? And if so, why is this a big deal?
Vmware says:
VMware proactively shares its source code and interfaces with other industry participants to enable the broad virtualization ecosystem today.
They can't have it both ways, stating in the same memo that the code was stolen and also "proactively shared". What the heck does proactively shared mean any way? Sending out sensitive hyper-visor source code to foreign military contractors seems at best, ill advised, but then to turn around and act all surprised and defensive when someone steals it from them seems a bit of a stretch.
Sig Battery depleted. Reverting to safe mode.
In all seriousness, this is a perfect example of why (most) source code should be open-source. Closed-source software depends on "you can't see inside this black box"/"security by obscurity" measures that are vulnerable because they cannot be made more secure by the community.
"Hey, Chien, it costs waaaaay too much for these VMWare licenses. it's too bad we can't build our own."
"Well, they did give us the source code. But they'd get mad at us."
"Not if we tell them it was stolen."
So means that the code is already available if you wanted it bad enough. *yawn*.
I can see reasons for it to be shared, like when companies want to tightly integrate their products and the published API's aren't at a low enough level to do it. Other companies do this too.
Problem is that today's friends are often tomorrows enemies. ( just look at the OS/2 debacle between IBM and Microsoft .. )
---- Booth was a patriot ----
I am waiting for my " I told you so!" moment.
Chinese contractors, Non Us Citizen contractors. Yes yes the cheapest bidders! As long as everyone is making thier 10% on thier stocks everyone is happy right?
No matter how well you understand how a piece of software is implemented, it shouldn't expose any sort of vulnerability. If VMWare legitimately has cause for concern, they were doing it wrong from the start.
While they have probably had viable reason to keep it closed (ESXi did enjoy a pretty secure technical advantage), it's probably approaching time for them to open source the hypervisor since there is now pretty viable competition from KVM and Xen nowadays. They currently are trying to hold their core technology capabilities hostage to force upsell into their management stack (e.g. the many features that are disabled except through vCenter that aren't really inherently requiring vCenter), but that strategy doesn't work when the prospective customers can jump ship pretty easily to less restrictive technologies.
XML is like violence. If it doesn't solve the problem, use more.
If you're serious you don't need source code anyway. Once you have the executable object code (as a paying customer or whatever), you can reverse engineer source code easily enough.
The original source code just makes it easier to understand how the object code works. And if the original source is sparsely commented, or the object code includes debugging info, the benefits are less.
Source code is most useful for situations where you don't have access to the object code, such as hosted services, embedded systems, etc.
torrent lik plz
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
I am quoting tfa from arstechnica:
the hacker Hardcore Charlie told Reuters earlier this month that he hacked into CEIEC seeking information on the US military campaign in Afghanistan
Apparently that hacker hacked into CEIEC - a Chinese military contractor, - looking for information on US military campaign in Afghanistan
It's like hacking into the system owned by Palestinians looking for information regarding Israelis military campaign
Makes a lot of sense, doesn't it?
Muchas Gracias, Señor Edward Snowden !
If you're dumb enough to give your source, or any other monetizable data to the Chinese, Indians, Pakistanis, etc. don't be surprised to find it suddenly (ahem) "stolen."
VMWare has nobody but it's naive, insular, overly trusting top management to blame. They have no effective legal recourse. What did they think would prevent this, a gentleman's' agreement?
Please do not read this sig. Thank you.
Well yes, VMware is still the market leader, but what would anyone do with this source code anyway? It's not as if VMware has anything left to teach the rest of the world about virtualization. The rest of the world has pretty much caught up and virtualization is a commodity now.
Tired of FB/Google censorship? Visit UNCENSORED!
No matter how well you understand how a piece of software is implemented, it shouldn't expose any sort of vulnerability.
When you say, "in theory" you need to include psychology and sociology, not just computer science.
There's a reason people clean up code before they release it as open source.
there is now pretty viable competition from KVM and Xen nowadays
The difference is that Xen has been looked at by the good guys and the bad guys for years. Like it or not ESX is now open source (non-OSI definition), but only for the bad guys.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
This is going to have impact on virtualisation / emulation crowd. If the code for that was leaked, it means at least a decade of tricks and optimisations in emulation (which is quite hard to do to be performant) was just made available to lurkers.
...how any company thinks placing industrial secrets on a World-facing node can in any way be described as a smart decision?
Or was it done deliberately?
Operation Guillotine is in effect.
A trade secret loses protection when released. Therefore why on earth is this a problem for anyone other than the keeper of the Secret?
.. when the most performant solution is free.
KVM is far faster then VMware's solution and far less resource intensive and can host Windows, Linux (and OSX with a little patching currently) guests.
Cutting through all the ego, bullshit and lies...
FUCK THREATPOST. and KASPERSKY THE FUCKIN NAZIS PROPAGANDA FEAR FACTORY.
use
http://www.h-online.com/
instead
And slashdot, STOP doin this shit. We get it you love DARPA and big brother.
Other VMs had source leaks, too.
Xen had a source leak.
Virtualbox had a source leak.
Even KVM had a source leak.
These VM people better get their act together!
if (LANG ~= en_US){DEFINE USE_TSA_SPYCODES}else{/*Fuck it, we are TSA */RETURN=0};
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
From the confirmation on VMware site
Yesterday, April 23, 2012, our security team became aware of the public posting of a single file from the VMware ESX source code and the possibility that more files may be posted in the future. The posted code and associated commentary dates to the 2003 to 2004 timeframe.
So, they have an 8-9 year old version of the source code. That is ESX version 2/2.5, right? If that is the case, not much was lost and most of the code has changed. This is before hardware virtualization and even 64-bit support.
Unless the hacker posts something indicating a newer version, then there doesn't seem much to worry about.