Subject: [TAG] [[email-masked]: CRYPTO-GRAM, March 15, 2004]

From: Ben Okopnik <[email-masked]>
Date: Mon, 15 Mar 2004 21:11:36 -0500

Here's an interesting bit from Bruce Schneier's latest "CRYPTO-GRAM". I
always knew that their code leaked and sucked, but 15% of the codebase?
Whew.

------------------------------------------------------------------------

           Microsoft Source Code Leak

On 13 February, it became known that Windows 2000 and Windows NT source 
code was circulating on the Internet.  Microsoft soon confirmed the 
leak, saying that "incomplete portions of Windows 2000 and NT 4.0 
source code was illegally made available on the Internet."  Microsoft 
downplayed the loss, and said it represented approximately 15% of 
Windows source code.  The leak was soon traced to a Microsoft partner, 
Mainsoft.  The Windows NT code that was leaked consisted of all of NT 
4.0 Service Pack 3 -- more than 27,000 files.  The Windows 2000 code 
only contained select portions of the source code, but did include the 
PKI module.

I am stunned that Microsoft didn't immediately know exactly who leaked 
the code.  There are easy techniques to give each version of the 
Microsoft source code files a unique watermark, such that any copy can 
be traced back to its source.  The fact that they didn't bother doing 
this says a lot about their own internal security.

------------------------------------------------------------------------

* Ben Okopnik * okopnik.freeshell.org * Technical Editor, Linux Gazette *
-=-=-=-=-=o0o=-=-=-=-= <http://linuxgazette.net/> =-=-=-=-=o0o=-=-=-=-=-
_______________________________________________
TAG mailing list
[email-masked]
http://linuxgazette.net/mailman/listinfo/tag

---

From: Thomas Adam <[email-masked]>
Date: Tue, 16 Mar 2004 03:10:51 +0000 (GMT)

--- Ben Okopnik <[email-masked]> wrote: 

"
> this says a lot about their own internal security.
"

I am no conspiracy theorist myself, but it does make you wonder whether
this was planned or whether Microsoft are gently smiling. At least this
way it gives Microsoft an edge and a means to say "upgrade to Windows XP"
so that they can stop supporting Win98/2K and its kindred....

/me walks off, past a guy with dark, dark sunglases. I know this guy.....

-- Thomas Adam

=====
"The Linux Weekend Mechanic" -- http://linuxgazette.net
"TAG Editor"                 -- http://linuxgazette.net

"<shrug> We'll just save up your sins, Thomas, and punish 
you for all of them at once when you get better. The 
experience will probably kill you. :)"

 -- Benjamin A. Okopnik (Linux Gazette Technical Editor)

___________________________________________________________
Yahoo! Messenger - Communicate instantly..."Ping" 
your friends today! Download Messenger Now 
http://uk.messenger.yahoo.com/download/index.html
_______________________________________________
TAG mailing list
[email-masked]
http://linuxgazette.net/mailman/listinfo/tag

---

From: Ben Okopnik <[email-masked]>
Date: Mon, 15 Mar 2004 22:26:12 -0500

> so that they can stop supporting Win98/2K and its kindred....

XP is based on 2k. I did, however, think of the effect of a bunch of
Linux people looking at the code and laughing, and Micr0s0ft recording
the exact _details_ of what they're laughing at so they can fix it...

Nah, that's too paranoid even even for the dark glasses.