7 ms·
32TB of Windows 10 internal builds, core source code leak online
- joe_the_user 9y agoIf nothing else, it would be interesting to compare code quality of this with leaks of much earlier Windows source files.
- 15charlimit 9y agoDoes this mean an individual could actually get their hands on the fabled Enterprise LTSB edition and thus actually have control over updates?
- my123 9y agoAn individual already can have an access to LTSB by paying for MSDN.
- 64738 9y agoAll I did was change a registry setting (or maybe it was a gpedit) to prevent automatic reboots. That was enough for me though, as I didn't appreciate my running apps being shutdown during the night.
- oneweekwonder 9y agoCan you maybe recall exactly what u did to stop your computer to automatically shutdown(and up)? I "resolved" the issue by dual booting. The second os(prev ubuntu, going to deb) changes something that takes away win ability to automagicly turn on my machine for updates.
- phaed 9y agoThis will make Windows less secure in the short term, but as good and bad actors find bugs and Microsoft patches them, they will end up with a hardened product. Their OS is now effectively open-source.
- my123 9y agoIt's only some core kernel and driver code, lower than 1% of the codebase.
- qb45 9y agoUSB and WiFi stacks can be fun, though.
- dsl 9y agoYup. It's the Windows Shared Source Kit, which is already mostly public. Many of the big security firms and government agencies already have licences to the full source code anyway. The only thing this really gains anyone is it possible some non-public debug symbols might have been left in some builds. Not earth shattering.
- pfranz 9y ago> Their OS is now effectively open-source. Ehh, Panic software had a good post-mortem talking about this potentially happening to them https://panic.com/blog/stolen-source-code/ https://panic.com/blog/stolen-source-code/ My favorite takeaway was, "With every day that passes, that stolen source code is more and more out-of-date." I remember hearing Windows source code leaks in the past (I see articles from 2000 and 2004) and remember hearing about problems with "clean room" implementations of open source SMB implementations. Yeah, the fundamentals and much of the source code will probably stick around for many, many years. But this has happened before and I don't see why this is any more of a big deal.
- nikanj 9y agoThe unstripped binaries are a huge benefit for non-black-hat developers too.
- gruez 9y agoMicrosoft actually provides symbols for most windows components through its symbol server.
- bitexploder 9y agoThe private symbols in these builds could actually be very useful. The article alluded there were private symbols. So, even if only 1% of the overall windows code was leaked, if there were, say private symbols for the heap allocator of the kernel, for a practiced reverse engineer that is pure gold. Not as good as code, but a hell of a lot better than having to figure everything out and name functions and symbols themselves.
- monochromatic 9y agoWhat kinds of private symbols aren't served by the symbol server?
- pzone 9y agoThere are two levels of debugging symbols. One is released with every Windows build, for end-users reporting back stack traces and the like. These are of the second more granular level - private debugging symbols available to developers only.
- my123 9y agoAll of them. The server serves public symbols. Private symbols have structure info and even local variable names, which are very useful.
- bjg 9y agohttps://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/public-and-private-symbols https://docs.microsoft.com/en-us/windows-hardware/drivers/de...
- dep_b 9y agoA new bold step in Microsoft's Open Source endeavors!
- kristofferR 9y agoCan someone with access take a more comprehensive screenshot of the contests?
- tzakrajs 9y agoJust imagine if the source code for SMB was let loose.
- rogersach 9y agoThey're disabling it later this year, so I wouldn't go that far.
- kristofferR 9y agoJust the outdated SMBv1 of course, SMB is still very much supported and in constant development.
- Spivak 9y agoAnd replacing it with what?
- pbhjpbhj 9y agoI'm imagining that other OS will be able to interop better with Windows increasing the value of Windows and improving experience of Windows by other OS users? What were you implying?
- palakchokshi 9y agoCan't imagine this was due to a hack of their systems. Seems more like an (ex)employee took a data dump and released it. Or it could be spear fishing.
- westmeal 9y agoLooks like the WINE developers are going to have the time of their lives.
- megous 9y agoNo, they will not.
- nxc18 9y agoIt looks like mainly kernel and drivers were leaked. WINE is emulating the Win32, which is distinct from the Windows NT kernel & drivers - kind of like how the Linux API is distinct from the Windows NT kernel, despite Windows supporting it. This might be a boon for the ReactOS folks, who are trying to implement the NT kernel, except for seeing the Windows source code automatically disqualifies you from being a contributor.
- kjaleshire 9y agoExactly. A few years ago the ReactOS developers had to stop all development for several months to perform a source code audit. This was meant to deflect accusations that they had derived code from disassembled Windows binaries. If anything, this could make their legal situation more sticky.
- wfunction 9y ago> A few years ago the ReactOS developers had to stop all development for several months to perform a source code audit. What kind of an audit can you do without access to the original software's source code? How would you tell if it's actually different?
- pmontra 9y agoThis is what they did https://www.reactos.org/wiki/Audit https://www.reactos.org/wiki/Audit
- 9y ago
- ryanlol 9y agohttp://www.bbc.com/news/technology-40366823 http://www.bbc.com/news/technology-40366823 Dead man's switch?
- throwaway201706 9y agoThrowaway account for obvious reasons. Does anyone have a link to the leaked data? At this point avoiding links is pointless as the source code will be essentially public knowledge in matter of days/weeks. Damage control is the only strategy left. The sooner security researchers outside Microsoft can start analyzing and reporting vulnerabilities, the better.
- ryanlol 9y agoSome of the leaked data seems to currently only be accessible on a https://www.betaarchive.com/ https://www.betaarchive.com/ , but your account won't be able to access it for a month or so.
- notyourwork 9y agoNot understanding why this comment needs a throwaway account?
- BoiledCabbage 9y agoMaybe he doesn't actually want it to research purposes, and actually wants a quick and easy way to find it for other less noble purposes. He never actually stated he wanted it for security, just left it easy to imply.
- driverdan 9y agoLooks like there's some debate as to whether or not this has been exaggerated: https://www.betaarchive.com/forum/viewtopic.php?t=37282 https://www.betaarchive.com/forum/viewtopic.php?t=37282 So far I haven't seen any links to source code. Quote from one of the admins: > Yes I have no idea where they got the 32TB stuff. We had a big leak of Win10 builds yes, but these were all Windows Insider stuff that were collected over time available to all Windows Insider members at one time or another. Edit: BA's official statement: https://www.betaarchive.com/forum/viewtopic.php?f=1&t=37283 https://www.betaarchive.com/forum/viewtopic.php?f=1&t=37283
- gpm 9y agoThere does seem to be some source, as (now, not when you posted) discussed in that thread. Here's a pastebin (taken from that thread) with some filenames, including, for example, usb drivers https://pastebin.com/raw/VGEbWVSM https://pastebin.com/raw/VGEbWVSM
- KGIII 9y agoIf you really want to see some Windows source code. You can just ask them - and they will send it to you. It's not open source and there are limits to what you can do with it. They call it their Shared Source Initiative. They want a reason for sharing it with you but I have used, 'I am just curious.' With that excuse, this was a long time ago when I still used Windows, I got the specific code I wanted for Outlook Express.
- wfunction 9y agoHow do you "ask them"? Do they have an email address for this? Or do you have to find the right guy on the team somehow?
- gtirloni 9y agoWindows Shared Source initiative has existed for what, over 10 years now? https://www.microsoft.com/en-us/sharedsource/ https://www.microsoft.com/en-us/sharedsource/ I think this "leak" is greatly exhagerated.
- deleted 9y ago[deleted]
- xefer 9y agoI must be possible to determine when this code was collected by matching the files to version control time stamps. I wonder if that could be used to narrow down who pulled the code during that window.
- jdubs 9y agoI guess windows 10 is now open source!
- drenvuk 9y agoLooks like the page where the source kit was listed was altered since the screenshot that's in the article was taken. I hope the files surface somewhere.
- blunte 9y agoGiven the other article I read today about US companies bowing to Russian requirements to review source code, I wonder if MS has also already given away code that can be studied for security gaps.
- Laforet 9y agoMicrosoft indeed make their sources available for review by major customers including governments. From what I heard this is done under NDA and reviewers are forbidden from taking the code away from MS facility.
- justforFranz 9y agoAmerica better get its act together about computer security.
- microcolonel 9y agoAs opposed to whom? Britain? Germany?
- deleted 9y ago[deleted]
- chris_wot 9y agoIf you develop WINE or ReactOS do NOT look at any of this code.
- Animats 9y agoIt seems that the "leak" was what you need to develop a driver. You can sign up for MSDN and get that, right? Does that come with the $3000/year it now costs to subscribe to MSDN?
- 80211 9y agoThis is a gross exaggeration. As far as I can see, what "leaked" was the "shared driver source kit" that nearly any hardware vendor (like chipset manufacturer) can get; basically anyone who puts up a few thousand bucks and signs an NDA.
- whatnotests 9y agoLinks or it didn't happen.
- jaimex2 9y agoI guess Microsoft really were serious about going open source.