Windows Source Code Leaked?

**Sanj[UK]** · 13th February 2004

Rumors abound web-wide that the Win2k and NT4 source code has been leaked and is floating around the internet. If true, it could spell trouble for Redmond and security experts alike. On the heels of a dangerous exploit this week comes a rumor than could prove downright painful. Neowin this afternoon announced that two packages containing Windows 2000 and NT4 source code were making the rounds. Slashdot soon followed up with their own mention of the rumored leak, effectively knocking Neowin off-line with traffic. So far the authenticity or extent of the leak has not been confirmed, though it does appear to be at least a portion of the code.

From the original Neowin report:

"At this time, it is hard to establish whether or not full code has leaked, and this will undoubtedly remain the situation until an attempt is made to compile them. Microsoft are currently unavailable for comment surrounding this leak so we have no official response from them at the time of writing.

This leak is a shock not only to Neowin, but to the wider IT industry. The ramifications of this leak are far reaching and devastating. This reporter does not wish to be sensationalist, but the number of industries and critical systems that are based around these technologies that could be damaged by new exploits found in this source code is something that doesn't bare thinking about.

We ask that for the wider benefit of the IT community that members and readers support Microsoft by forwarding anything they know about the leak to the Microsoft's Anti-Piracy department."

**Update** The source code, which was leaked initially to a P2P network, spread quickly to IRC, and is now heading for all the large warez channels out there. This really is a shame, because the high-security nature of Windows 2000 is likely to be compromised by an open codebase.

At the current time, anybody who has malicious intentions regarding your Windows 2000 computer can merely browse through the source code, find an unpatched hole, and then root you. If you're currently running Windows 2000, switch your machine off. If you can't, put a firewall up.

This is merely precautionary, as we still do not know the authenticity of the code. At the moment, OSFocus is trying to ascertain it through our MS sources, and we will post any updates as and when we get them.

This source code leak is one of the worst things I have ever come across in my experience as a tech/beta journalist and developer. Whoever leaked it should be dealt with in much the same way muderers and child molesters are. 25 years in jail for leaking Windows' source code? Sounds about right to me.

We will not assist you in finding this code, and we will not give it to you. We do not have it, and we do not want you to send it to us. The end.

from www.ircspy.com

**Yazmon** · 13th February 2004

**Update** The source code, which was leaked initially to a P2P network, spread quickly to IRC, and is now heading for all the large warez channels out there. This really is a shame, because the high-security nature of Windows 2000 is likely to be compromised by an open codebase.

At the current time, anybody who has malicious intentions regarding your Windows 2000 computer can merely browse through the source code, find an unpatched hole, and then root you. If you're currently running Windows 2000, switch your machine off. If you can't, put a firewall up.

This is merely precautionary, as we still do not know the authenticity of the code. At the moment, OSFocus is trying to ascertain it through our MS sources, and we will post any updates as and when we get them.

This source code leak is one of the worst things I have ever come across in my experience as a tech/beta journalist and developer. Whoever leaked it should be dealt with in much the same way muderers and child molesters are. 25 years in jail for leaking Windows' source code? Sounds about right to me.

We will not assist you in finding this code, and we will not give it to you. We do not have it, and we do not want you to send it to us. The end.

Pahahahaha. Some people know nothing. Theres too many stupid comments in taht to respond to.

I know for a fact that ealier versions of Window's code have been leaked. Did it spell the end of the universe, nope.

**TwoPlAnKs** · 13th February 2004

linux - one of the most secure operating systems ever has compeltely open source code

this makes it more secure since lots of people can find holes and fix them

the problem is that with windows when folk find holes they are more likely to exploit rahter than fix, but most script kiddies wouldnt be able to find holes anyway

Robbie Vox · 13th February 2004

Whoever leaked it should be dealt with in much the same way muderers and child molesters are. 25 years in jail for leaking Windows' source code? Sounds about right to me.

how fu(king stupid

like the world is gonna end, like it dont happen toother ppl. Just seem the person reoprting this is a biased

**4me2** · 13th February 2004

Part of WinNT4 and Win2000 sources leaked?

From neowin.net:

Neowin has learned of shocking and potentially devastating news. It would appear that two packages are circulating on the internet, one being the source code to Windows 2000, and the other being the source code to Windows NT. At this time, it is hard to establish whether or not full code has leaked, and this will undoubtedly remain the situation until an attempt is made to compile them. Microsoft are currently unavailable for comment surrounding this leak so we have no official response from them at the time of writing.

From zdnet.com:

The 203MB file expands to just under 660MB. The entire source code is believed to be about 40GB, meaning that the file circulating would be only a fraction of the full code base--if it is authentic.
Ruiu (security consultant and the organizer of the CanSecWest security conference), who has seen the file, believes it to be authentic. "It looks real," he said. "You can't build Windows, however. It's just a bunch of chunks of the operating system."

"It's definitely not a good thing if black hats have the source code," said Oliver Friedrichs, senior manager with antivirus company Symantec's security response center. If the source code has been released, "the underground can look at the code without legitimate security researchers being able to find vulnerabilities first."
But Microsoft downplayed any security issue.
"If a small section of Windows source code were to be available, it would be a matter of intellectual property rights rather than security," Microsoft said.

More info: neowin.net, zdnet.com, slashdot.org, infoworld.com, news.yahoo.com, betanews.com, ...

http://www.xbox-scene.com/index.php

**Gel** · 13th February 2004

I'm being a dumbass but how do they fit 40gb onto 1 CDR?

The only way I can think of is if it is put through a complier?

Feel free to ridicule my comments.

**marcode** · 13th February 2004

if u want it u can get the torrent here...

http://mysite.freeserve.com/marcode/...e.Code.torrent

not very exciting, but some of the commenting is quite funny..

**TwoPlAnKs** · 13th February 2004

Originally Posted by Gel

I'm being a dumbass but how do they fit 40gb onto 1 CDR?

The only way I can think of is if it is put through a complier?

Feel free to ridicule my comments.

Yeah they compile it, making it into object code or binary code. This is much smaller than the source since it doenst have comments or anything

the user never sees the source code for windows since it is "closed source"

it is easy to steal chunks of code but very very hard to steal chunks of binary, so it is microsofts way of protecteing themselves really