32TB of Windows 10 Internal Builds, Core Source Code Leak Online (theregister.co.uk) 201
According to an exclusive report via The Register, "a massive trove of Microsoft's internal Windows operating system builds and chunks of its core source code have leaked online." From the report: The data -- some 32TB of installation images and software blueprints that compress down to 8TB -- were uploaded to betaarchive.com, the latest load of files provided just earlier this week. It is believed the data has been exfiltrated from Microsoft's in-house systems since around March. The leaked code is Microsoft's Shared Source Kit: according to people who have seen its contents, it includes the source to the base Windows 10 hardware drivers plus Redmond's PnP code, its USB and Wi-Fi stacks, its storage drivers, and ARM-specific OneCore kernel code. Anyone who has this information can scour it for security vulnerabilities, which could be exploited to hack Windows systems worldwide. The code runs at the heart of the operating system, at some of its most trusted levels. In addition to this, hundreds of top-secret builds of Windows 10 and Windows Server 2016, none of which have been released to the public, have been leaked along with copies of officially released versions.
32TB? (Score:2)
Going to need a new storage array...
Re: 32TB? (Score:2)
It isn't that interesting. Save the space. They are mostly just builds from the Insider Program, according to the folks with the actual data.
Re: (Score:2)
This has now been verified by multiple independent parties.
Re: (Score:2)
It's false.
Just the early preview versions.
Re: (Score:2)
That's what I said. ;-) Though two folks have said there's a proprietary debugger. I am not sure of the validity of that one.
Re: (Score:2)
There doesn't actually appear to be any source code in the files. Multiple parties have gone over it. It's just Insider Program builds, some tools (that may be handy - as they are special debuggers I guess), and a whole mess of internal nightly builds.
I haven't downloaded the files, but those who have checked it out are people that I'm inclined to trust - based on history. It's largely nothing. The debugging tools may reveal something and someone, with enough time, may be able to disassemble binaries that w
Re: (Score:2)
I'd be more interested in finding out what the telemetry data actually contains.
Re: (Score:1)
Re: (Score:3)
Going to need a new OS because now the malware creators have the ability to find yet undiscovered security holes and utilize them.
Re: (Score:1)
Going to need a new OS because now the malware creators have the ability to find yet undiscovered security holes and utilize them.
Oh really? Is that what they meant in the summary by: "Anyone who has this information can scour it for security vulnerabilities, which could be exploited to hack Windows systems worldwide."? Thanks for your insight.
Re: 32TB? (Score:5, Funny)
Better not use Linux or FreeBSD. I hear they let anyone look at the source.
Re: (Score:2)
They had that capability before. It may not even have been that much more effort. Reviewing source-code is time-consuming, demanding and expensive.
Re: (Score:2)
Or, oddly enough, the opposite might happen. Maybe someone will actually submit patches to fix all those bugs.
Neat. (Score:5, Interesting)
Maybe it tells us the secret to shutting down a laptop using ACPI in a way that doesn't drain the battery dead 2 hours after it "powers off" using Linux
Re: (Score:2)
Or why the machine can't wake up if I let it park the CPU in Windows 10 but it worked fine in Windows 8.1.
(Phenom X4 9850 on ASUS 790FX board.)
Re: (Score:2)
Re: (Score:1)
I said CPU parking because I don't know the name of it.
There's S1 and S3 and one is a a deeper sleep than the other and with the deeper sleep the CPU fan turns off as-well among other things but if I use that one then the machine can't be started without a cold reboot again. It used to work in Windows 8 but doesn't in Windows 10.
M3A32-MVP Deluxe and .. yet another one is what I have.
I know it was you Comey. Horrible. Horrible. (Score:5, Funny)
Really very, very horrible. Really horrible. Very very not good at all, let me tell you. Leakers on any media, horrible. Don't watch that video.
Betaarchive admin official statement (Score:5, Informative)
Seems The Register story may not be accurate, or if you prefer FAKE NEWS!
Re: (Score:2)
Dammit.
Seriously though, thanks. It is interesting to see just HOW FUCKING FAR OFF the claimed numbers are to the real numbers. I suck at math so I've no idea how many orders of magnitude they are off by, but it's fucking fantasy land for certain.
32TB vs. 1.2GB and seems rather benign compared to the sensationalism.
Thanks for putting things in perspective.
Media and politicians, repeatedly shooting themselves in the foot repeatedly for our
Re: (Score:2)
The folder itself was 1.2GB in size, contained 12 releases each being 100MB. This is far from the claimed “32TB” as stated in The Register’s article, and cannot possibly cover “core source code” as it would be simply too small, not to mention it is against our rules to store such data.
I though "too small" was Oberon's 12 kLOCs, but 1.2 GB or archives? Jevons' paradox at work right there...
Re: (Score:2)
What would be horrible would be if the Microsoft Certificate server was compromised allowing anyone to create certificates in the name of Microsoft using their private key.
On the other hand - if that happened we wouldn't be told because it would compromise every Windows computer out there.
Oh no, security problems might be found! (Score:5, Insightful)
Anyone who has this information can scour it for security vulnerabilities, which could be exploited to hack Windows systems worldwide.
You mean like.. BSD and Linux? Sounds like the way it should be -- the security by obscurity fad faded a long time ago.
Re: (Score:1)
Re: (Score:2)
the source code can make generating the exploit once you have found the vulnerability much easier.
That's an understatement.
Re: (Score:2)
Actually, it is not. In many cases the source will not help the attacker much or at all. It does make fixing a vulnerability a lot easier though.
Re: (Score:2)
I actually have hands-on experience in this area. What the general public thinks and what actual experts know is often quite a bit different. This is one such case.
Re: (Score:2)
But even though code analysis is painful and slow, it doesn't stop the OpenBSD people and others from doing some, historically demonstrating good results for their efforts.
Re: (Score:2)
The OpenBSD project has a proactive approach to security https://www.openbsd.org/securi... [openbsd.org] with people who do what they do because they want to do it.
The Windows model is perpetuate the need for patches so you can make the customer dependent on continuous releases. They never had any intent to procure a secure system and likely never will.
Re: (Score:2)
Software freedom still missing (Score:2)
But the freedoms of free software are still missing. Having a snapshot of what Windows code looked like at one time doesn't grant one the freedom to improve that code, distribute (including commercially) that code (or a variant of that code), and thus control one's computer or help one's community by distributing improved code.
Re: Oh no, security problems might be found! (Score:4, Insightful)
"Many eyes makes bugs shallow" is not so much the point...
Rather is having a level playing field for everyone, anyone can see the code, good and bad guys alike.
With closed source *you* probably don't have the code and white hat security researchers probably don't have the code, but you have no idea who else (NSA and similar agencies, criminals etc) does. Chances are with closed source those who do have the code are more likely to have hostile motives.
Re: (Score:2)
Chances are with closed source those who do have the code are more likely to have hostile motives.
Like the vendor.
old crap (Score:1)
Telemetry (Score:5, Interesting)
Re: (Score:1)
Or another, equally likely, possibility is this is a controlled leak and it's meant to mislead us about the nature of the telemetry.
But this isn't the full source is it? So probably we'll never know. But do we need to? The Corporate Plutocracy is attempting to destroy us all anyway. Until there is a movement against the state, nothing matters but survival.
Standing by to be modded down by cowards who refuse to realize the implications of things like federally mandated education standards, mass surveillance,
Re: (Score:2)
Standing by to be modded down by cowards who refuse to realize the implications of things like federally mandated education standards, mass surveillance, media consolidation, etc.
You must be new here.
Re: (Score:2)
If you want to know that just read through these 94 pages: https://docs.microsoft.com/en-... [microsoft.com]
Re: (Score:3)
Re: (Score:2)
Interestingly the less complete the list is the less care about their collection. The more data that is collected the less likely any database makes sense. The less likely they are able to extract information from it. The less likely I am to be affected if someone dumped the database online.
Code can change (so can undocumented backdoors) (Score:2)
Until Microsoft changes the source code to do something else. That's the thing about source code: people alter it and make programs do different things, so we need the freedoms of free software to control our computers, help keep people honest, and treat each other ethically.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Apple/Google got away with it because a phones were a new paradigm without preexisting standards for user control and spying and whatnot. They did shit you would never have been able to get away with on a PC a decade ago, but no one complained because it wasn't a PC (AOL had pioneered the 'walled garden' thing years before and was met with universal derision). Then once phones and their attendant privacy invasions became ubiquitous and the public had gotten used to the idea of being tracked and monitored
Re: (Score:2)
The same. They are essentially in the Tablet market what MS is for Desktops. And the phone market they share with a company that's just as bad.
Re: (Score:2)
An aside to this thread, as a child of the MS dominated 90s, I sort of dig Android being dominant on phones, Apple having tablets, MS having the desktop, and Linux more or less having servers with a healthy competition in each segment. It's not a perfect situation but it beats the shit of the bad old days when IE 6 was "the internet."
>inb4 everything is just as bad as it ever was or worse
Re: (Score:2)
You, Sir, are the worst spy ever. rofl
Are you now happy?
Re: (Score:2)
Maybe it's a name and he misspelled Rolf?
OMG (Score:2, Insightful)
"Many eyes" (Score:1)
Security!
Wait for it: Microsoft Intentionally Leaked It (Score:2)
Re: (Score:1)
they'll blame it on their migration to git [arstechnica.com] as a way to tarnish linus' name, not the fact they used windows shit server 2k13 to host it on.
Okay.... (Score:2)
/me goes to the store to get popcorn
32 TB? (Score:2)
How much is it if you skip all the #ifdef BUGS sections?
Re:32 TB? (Score:5, Funny)
How much is it if you skip all the #ifdef BUGS sections?
That compiles down to 640k, just enough for everybody
Too bad (Score:2, Insightful)
Too bad it STILL won't tell anyone what is actually on a machine when a binary MS-Windows is installed. You still won't know what back doors, spyware, weakened encryption, "telemetry" sharing, and extra code was injected for the governments. And good luck on building something you will be able to actually install and use. This breech is unlikely to help anyone but black hatters, looking for vulnerabilities.
Meanwhile, grab distro Linux sources legally, see anything and everything you desire, and compile i
Re: (Score:2)
I don't know that on any other installation either. I simply trust that any vendor provides me a binary that matches its source code. I and 99.999% of the people using computers have zero ability to audit binaries against source code. And I'm willing to bet you've never done it for your OS too.
Re: (Score:3)
It is the complete lack of t
Re: (Score:2)
+1 insightful
I couldn't have worded it better if I tried.
Re: (Score:2)
but a network of trust - code that is able to be audited by a network of known individuals who build trust in that code.
Sorry but the benefit of a network of trust breaks down very rapidly when we actually look at how often projects actually get a security audit (you can probably count them on one hand) and how that audit has absolutely no relevance to the final binary that you download, not to mention the fact that by the time any audit process is finished you'll be very many commits behind.
The level of trust I have for software ranks as follows: Closed source > Open source > Closed source which has reached monopoly s
Security vulnerabilities? (Score:1)
Time for OS/2 (Score:2)
Re: (Score:2)
Re: (Score:2)
Who *WANTS* it?
I would, if it meant we could port SOM and the Workplace Shell to Linux.
Yaz
Re: (Score:2)
I would, if it meant we could port SOM and the Workplace Shell to Linux.
You can make fvwm work like the workplace shell if you want. Why would you want SOM? You can get a real CORBA ORB if you want.
Re: (Score:2)
You can probably make fvwm *look* vaguely like workplace shell, but I highly doubt you can get it to function like the workplace shell.
No, you can! You can even make it use inexplicable mouse button mappings, just like OS/2!
Re: (Score:2)
Anyone that want a great upload quota on warez BBSes.
How's that Windows Security? (Score:2)
Hahahahahahaha!!!!
This happened in the '90s (Score:2)
Re: (Score:2)
Virtual memory logic was around before Microsoft even thought of it. Maybe you think of the alleged Unix source code issues related to SCO?
In other news (Score:2)
In other news, thousands of programmers appear to have gone blind and insane while screaming, "The Spaghetti! The Horror! It burns my eyes!"
How do you search multi terrabytes of source? (Score:2)
How do you find anything in thirty two or whatever number of terrabytes? Are their algorithms to search for certain patterns?
Re: (Score:2)
Re: (Score:2)
Oh no! This is the Spaguetti Monster of that church everyone thought was created for mockery, BUT NO, THEY WERE RIGHT ALL THIS TIME! WE'RE ALL DOOMED!!!
Re: In other news (Score:2)
Is having 32 TB of Microsoft code the crime or the punishment?
Irony (Score:2)
In a surprising development to the business world (Score:1)
Whew ! (Score:2)
Waste (Score:4, Funny)
Use it to build a fucking non-updating distro (Score:2)
Every time I try to use a Windows laptop that I keep for Steam/Oculus games, it needs to install updates, or has installed updates and lost my game progress, or asks me to adjust my privacy settings for Windows 10 whatever edition. With source, one can presumably build a non-nagging distro with working DirectX and live free of this crap?
Re: (Score:3)
Start, run, services.msc
Scroll to Windows Updates
Right-click, stop
Right-click, properties
Select startup type, choose 'disabled', apply
OK, close
Happy now? Don't even need to reboot. Wow, didn't even need a command prompt to make that happen (although you could it that way if want to).
You can visit wsusoffline once a month or so - at *your* convenience, to download and install updates. BTW, you should donate a dollar or three to the site if you find it useful (not my site, just a happy user).
FWIW, mint and ub
Leaking source code (Score:1)
Relax... (Score:3)
Relax! Our most valuable and most secure operating system is out there for free! How am I suppose to explain that?
I don't know... Say it was all part of the plan!
Eagerly waiting (Score:1)
For the real story to be mined out of this trove.
I predict we will see that consumer and small business software is heavily back-doored while corporate software is less so.
Winbeta themselves have refuted almost everything (Score:5, Informative)
Source [betaarchive.com]
Really hope... (Score:2)
Is this a Git issue? They just switched. (Score:2)
Re: (Score:2)
Re: Top Secret? (Score:2)
Re: (Score:2)
Not a Governmental Top Secret classification, just a company top secret classification.
Just stating "Classified" doesn't indicate anything about the classification level. It can be classified as "Open" as well.
Re: (Score:2)
This is just hyperbole. Basically no private company does "Top Secret". The maximum level is usually "Secret" and that is it.
Re: (Score:1)
I predict that Slashdot readers will be too cowardly to address my observation.
It's off-topic. Now, back to your containment board --> /pol/
Re:Reminds me ... (Score:4, Informative)
Then you should have redesigned the network such that the printers were not directly accessible to users, and they had to funnel data through a central print server which *does* log what was printed and by whom. Aside from the reason given (likely a severe violation of the company code of conduct), you get other benefits too like keeping (usually horrendously insecure) printers away from the user network, being able to tell who's printing copies of company data that might have leaked out, and keeping track of how much is being printed.
Re: (Score:2)
Disagree.
Sure, printing porn is a termination offense, but the damage (offending sensibilities) vs ROI of your proposal is simply not there.
Re: (Score:2)
No, it's true. Printers are often tragically insecure, especially Postscript printers but including many if not all kinds. It's daft to put them on the same network as anything else.
Re: (Score:2)
I think you're adding a lot more to my example than is necessary for me to make my point.
I'm simply stating that infosec doesn't nothing to address inside jobs.
The guy who printed the porn did it from within the perimeter.
It wasn't done by an actor from Romania.
Re: (Score:2)
Then you should have redesigned the network such that the printers were not directly accessible to users, and they had to funnel data through a central print server which *does* log what was printed and by whom. Aside from the reason given (likely a severe violation of the company code of conduct), you get other benefits too like keeping (usually horrendously insecure) printers away from the user network, being able to tell who's printing copies of company data that might have leaked out, and keeping track of how much is being printed.
Please explain how he could have implemented such a system after the fact.
And moving forward... why? It sounds like a lot of effort and company money to waste just because the boss is a prude. . . It is a fire-able offense, but was likely one guy costing the company $10 a month in consumables. There are innumerable, more severely business-damaging offenses to be on the lookout for.
Re: (Score:2)
2 years in prison is not very likely. In civilized countries you will get a deal instead.
Re: (Score:2)
Here you go:
https://github.com/Microsoft [github.com]
Re: (Score:2)