Windows code up for grabs

Microsoft is investigating how a file containing some protected source code to Windows 2000 was posted to several underground sites and chat rooms.

As previously reported, Microsoft spokesman Tom Pilla said late Thursday that incomplete portions of Windows 2000 and Windows NT were illegally posted to the Internet.

On Friday, Internet users were ferociously downloading pirated versions of the source code, stoking concerns that hackers and virus writers could use it for a new wave of cyberattacks.

"It's illegal for third parties to post Microsoft source code," Pilla said. "We obviously take that very seriously."

Microsoft said it is investigating how the code got on the Internet and is working with law enforcement agencies. "We will take all appropriate legal actions as we move forward with the investigation," Pilla said.

The leak may have been at a software developer, Microsoft said, but it was no closer on Friday to pinpointing the suspect.

Pilla said that at this point there should be no effect on customers. As for the long-term security impact, Pilla noted that "this is not buildable or executable code...nor is it the complete source code."

The 203MB file contains code from Microsoft's enterprise operating system, but the code was clearly incomplete, said Dragos Ruiu, a security consultant and the organizer of the CanSecWest security conference, who has examined the file listing.

"It was on the peer-to-peer networks and IRC (Internet relay chat) today," Ruiu said. "Everybody has got it--it's widespread now."

		Get Up to Speed on... Enterprise security Get the latest headlines and company-specific news in our expanded GUTS section.

Various computer security firms reported Friday that two compressed files--one at 203MB and another at 229MB--were being widely distributed on scores of online exchanges.

The 203MB file expands to just under 660MB, Ruiu said, noting that the final code size almost perfectly matches the capacity of a typical CD-ROM. The entire source code, he said, is believed to be about 40GB, meaning that the file circulating is only a fraction of the full code base.

"It looks real," he said. "You can't build Windows, however. It's just a bunch of chunks of the operating system."

Earlier Thursday, a source located a file purporting to be the code on a Web site, but the file was removed from the Internet before it could be completely downloaded.

The releases of the source code created a buzz on the Internet but also worried some security experts.

"It's definitely not a good thing if 'black hats' have the source code," said Oliver Friedrichs, senior manager with antivirus company Symantec's security response center. "The underground can look at the code without legitimate security researchers being able to find vulnerabilities first."

But Microsoft downplayed the security angle.

In its statement, the company said the main concern is the potential theft of its handiwork rather than the possible security threat that such a leak might pose.

"If a small section of Windows source code were to be available, it would be a matter of intellectual property rights rather than security," Microsoft said.

Getting to the source
Microsoft zealously guards the source code to the various versions of its Windows operating system, sharing it only with universities and government agencies that sign agreements not to release the code. While working versions of Microsoft's operating system have occasionally leaked to the Internet, actual source code leaks have been rare.

Although Microsoft Chairman Bill Gates has publicly bragged about the security of Windows, even Microsoft fears the release of its code. In testimony during the Microsoft antitrust trial, Jim Allchin, the company's senior vice president for Windows, said opening up the company's source code could be devastating for the operating system's security.

"The more (that) creators of viruses know about how antivirus mechanisms in Windows operating systems work, the easier it will be to create viruses or disable or destroy those mechanisms," Allchin testified during a May 2002 antitrust trial.

Allchin made the statements while defending the company against legal remedies supported by nine states in its antitrust case that would have compelled Microsoft to give away the source code to Internet Explorer.

Allchin's fears are not misplaced, said Thor Larholm, senior security researcher with security consultancy PiVX Solutions.

"Just look at the amount of vulnerabilities that are discovered without the source code," he said. "The majority of Windows servers are still running Windows 2000. Furthermore, Windows 2000 has a lot of shared code that is still being used by Windows XP and Windows Server 2003."

However, other security experts believe that fears are misplaced about a leak leading to the widespread discovery of vulnerabilities in the code.

"Theoretically, to a good reverse engineer, all code is open source," said a Microsoft security consultant who asked not to be identified. He added that the size of the compressed file that was being passed around the Internet sounded about right.

In the end, however, the mistake that made Microsoft's code public might result in benefits similar to open-source code, Ruiu said.

"Short term, there might be problem (as bugs are found), but long term it might be good for them," he said. "Their code might become more secure."

Reuters and CNET News.com's Ina Fried contributed to this report.