Microsoft claims to love open source – this alleged leak of Windows XP code is probably not what it had in mind, tho
- Reference: 1601059153
- News link: https://www.theregister.co.uk/2020/09/25/windowsxp_source_code_leak/
- Source link:
Heck, there's no physical swag for attendees nowadays so how about a big ol' source dump?
The source of the alleged code leak is unclear; a torrent for the archive popped up on internet armpit 4chan and contains what appears to be Windows XP Service Pack 1, as well as some other past-their-sell-by-date flavours of Microsoft's greatest hits.
The Microsoft source boat is infamously leaky and unseaworthy. Chunks of Windows code [2]seeped out from under the door in 2017, giving those not in the magic Microsoft circle an insight into how the company's systems work. Another leak, [3]in 2004 , saw bits of Windows NT4 and 2000 source from the turn of the century nose their way into the sunlight.
This week's leak looks both relatively complete and the real thing, [4]according to experts. However, that could change as those with the skills dig into what has been exposed.
A Microsoft spokesperson told The Register : "We are investigating and will take appropriate action to help keep customers protected."
Microsoft leaks 6.5TB in Bing search data via unsecured Elastic server. *Insert 'Wow... that much?' joke here* [5]READ MORE
Support for Windows XP finally came to an end in 2014, although the Windows [6]POSReady 2009 (beloved by our [7]bork pages and based on Windows XP SP3) lingered on [8]until 2019 . Support for Service Pack 1, which is what this leak appears to be, [9]ended in 2006 .
Service Pack 2, which debuted in August 2004, was the one where Microsoft took some determined efforts to deal with XP's habit of welcoming attackers with open arms. SP2 added a firewall and the Security Center.
As miscreants pore over the source in search of new and exciting exploits for old machines, many may shrug and point out that XP, bar the POS version, is long out of support and only a fool would still entrust the venerable OS with any task other than target practice.
That said, back in March [10]we revealed the operating system was still at work within the bowels of the UK's Ministry of Justice, and we doubt Blighty is alone in having the code still knocking around the place. We'll draw a veil over [11]the whole NHS thing .
While parts of Microsoft may have embraced open source with the fervour of the born again, MICROS~1 keeps the code of its operating systems secret (unless one is a government or hardware maker and [12]asks really nicely ). As such, it is tricky to know just how much legacy code from Windows XP might be lurking in the damp basement of its newest and shiniest.
The alleged leak aside, the incident is a reminder for those still running the elderly operating system that the time to migrate to pastures new is well overdue. And for others, an excuse for a bit of sport: below is apparently part of the SMB code that was exploited by the NSA's [13]EternalBlue tool that was later stolen and leaked online and used by the WannaCry ransomware. Given the security warnings in the routine's code comments, if we were a government agency with access to the source code, this is probably where we'd start looking for bugs... ®
Warning: 27 years from now, a bug in this function will be used by EternalBlue.
The Windows XP source code leak is a welcome surprise. [14]pic.twitter.com/M1MQpuyugm — Tamas Boczan (@tamas_boczan) [15]September 24, 2020
Get our [16]Tech Resources
[1] https://twitter.com/RoninDey/status/1309275918943301636
[2] https://www.theregister.com/2017/06/23/windows_10_leak/
[3] https://www.theregister.com/2004/02/13/ms_windows_source_code_escapes/
[4] https://twitter.com/Laughing_Mantis/status/1309276455432458240
[5] https://www.theregister.com/2020/09/23/microsoft_leaks_over_65tb_bing/
[6] https://www.theregister.com/2019/04/10/windows_xp_finally_ends/
[7] https://search.theregister.com/?q=bork%21bork%21bork%21&site=
[8] https://docs.microsoft.com/en-gb/lifecycle/products/windows-embedded-posready-2009
[9] https://docs.microsoft.com/en-gb/lifecycle/products/windows-xp
[10] https://www.theregister.com/2020/03/11/windows_xp_ministry_justice_vpn_workaround/
[11] https://www.theregister.com/2020/01/29/ransomware_in_the_nhs_survey/
[12] https://www.microsoft.com/en-us/securityengineering/gsp
[13] https://www.theregister.com/2017/04/14/latest_shadow_brokers_data_dump/
[14] https://t.co/M1MQpuyugm
[15] https://twitter.com/tamas_boczan/status/1309267624325509121?ref_src=twsrc%5Etfw
[16] https://whitepapers.theregister.com/
Obscurity
Because "millions of eyes looking at [the] source code" has proven to be any better?
Just sayin'
Funny part
To me, that Twitter code snippet has a very good quality comment.
Then again, the "security be damned!" in the comment is just cherry on the cake.
Shared code base
Since XP and Windows 10 share a large common code base this leak might be very helpful to intelligence agencies and hackers hunting zero-days.
Many parts of Windows haven't been touched in ages since things keep being bolted onto the Windows NT codebase. Some parts may even go back to the 1980's, as the Windows Message loop was present in the character-based Windows 1.0.
Re: Shared code base
Well if you look, start with all of the code in the old control panel, and the MMC source code.
There are so many horrors... things that cannot be unseen...
Re: Shared code base
Intelligence agencies almost certainly have the code already. Even MVPs were given access to a fair bit of the code in years gone by. However, I'd be surprised if much of the code is still present unchanged in Win10. There are two reasons for this.
Firstly, C++ has changed significantly over this period and MSVC has followed those changes. Also, Microsoft's own static checking tools have evolved. I doubt the XP source code would get through the build process today.
Secondly, what the code is trying to do, in terms of protocols like SSL and SMB, also changes if you give them long enough. Even if you set out to be completely backwards compatible, you are going to end up changing pretty much every line of the implementation over a two-decade period because the "same" code has to support the newer protocols and increasingly treat the older protocol as a special case rather than the main event.
There's certainly no way the message pump will have survived from Win1. That was a co-operative multi-tasking system that obsessed over swapping segments in and out of the active stack frame. The "modern" (NT and beyond) message pump divides its responsibilities between the OS/device layer and a delivery layer, where one instance of the delivery layer runs in each UI thread on the system. The latter hasn't changed much in 30 years, but it has had several accessibility and hooking mechanisms added (and removed) over that time, and it also has to co-operate with "new" environments like .NET.
So, no, the worry here for Microsoft is not that anything of value has been leaked, it is that anything at all has leaked. Presumably the XP code is guarded in much the same way that its successors is guarded, so if there is a hole in the wall ...
How to destroy your competitors
Give them Windows XP source code and tell them to use it in their products as the code is solid...
OLne wonders what the source of this is. Some ex MS employee rediscovered it in a backup of a home computer somewhere? A tech looking at old tapes of stuff and as a Linux fanboi decided to release it?
If it was someone who had acces to current code and a grievance surely they would release that instead?
Yes there will be common code between this and Windows 10, particularly in the aged code around 8 and 16 bit support that is probably still in there. AN perhaps it is time for MS to do a proper clear out of the all the old detrius that even refernces anything less than 32 bit.
It's 10% conspiracy garbage
There's also a bunch of awful conspiracy theory crap, a copy of "Revolution OS", and a bunch of other not-source-code stuff in the archive. Because the windows source is totally related to how covid19 is spread by 5g towers. Or something. Apparently.
....errr... i mean... so I'm told - I'd obviously never download such a thing
If one was downloading the torrent, I'd suggest skipping the 'media' directory.
...hypothetically speaking, of course...
> A Microsoft spokesperson told The Register: "We are investigating and will take appropriate action to help keep customers protected."
Nothing quite like security through obscurity. :)