13 ms·
Lapsus$ hackers leak 37GB of Microsoft's alleged source code
- phendrenad2 5y agoIt's too bad it's always existing companies that get their source leaked. Just once I'd like to see "Archive of Digital Equipment Corporation source code leaked online". I can dream...
- tablespoon 5y ago> It's too bad it's always existing companies that get their source leaked. Just once I'd like to see "Archive of Digital Equipment Corporation source code leaked online". I can dream... The problem is those companies are defunct, so their source repositories may not even exist anymore, let alone be online, e.g.: http://www.chrisfenton.com/homebrew-cray-1a/ http://www.chrisfenton.com/homebrew-cray-1a/ > After searching the internet exhaustively, I contacted the Computer History Musuem and they didn’t have any either. They also informed me that apparently SGI destroyed Cray’s old software archives before spinning them off again in the late 90’s. I know at my employer, there's always pressure to half-ass things that aren't directly connected to some mechanism for making money. We recently migrated our company intranet site from one vendor to another, and the team that was running that project it as a "feature" that they would help us "clean up" by not assisting us migrating anything older than one year. Similarly, source control migrations (of which we've done several) often drop history, since it's usually way easier just to download the latest version and check it into the new system than figure out how to migrate the metadata. IIRC, Microsoft's TFS-VC to git migration tool will only migrate something like 180 days of history.
- snvzz 5y agoIt would be fun if a backdoor was found in there.
- nonrandomstring 5y ago> alleged source code I may just be line noise, but compiles and runs just as well.
- marginalia_nu 5y agoSo, perl?
- nonrandomstring 5y agofave Perl dis; "an explosion happened at the ASCII factory"
- PLG88 5y agoIt saddens me that Microsoft cannot properly implement zero trust principles or account based access control to their DevOps environment. VDI and VPNs are not secure, no networks are secure!
- caaqil 5y ago> zero trust https://twitter.com/cyb3rops/status/1506169666020028416 https://twitter.com/cyb3rops/status/1506169666020028416
- pwdisswordfish9 5y agoSo you're saying Microsoft should have put their source code on a blockchain?
- cenal 5y agoI thought they tried that already with Windows Vista. I mean... it seemed to at least share a lot with Blockchain since the initial release had more variations than anyone cared to track, was slow, confusing, expensive, and hardly anyone used it despite all of the hype....
- hdjjhhvvhga 5y agoFirst, I wouldn't be so harsh on them: statistically, the probability of successful attacks increases with the size of the company, and having lived long enough I consider it a miracle that the likes of Apple and Microsoft had seen so few leaks. Second, zero trust is a very specific concept that basically refers to not trusting networks traditionally considered as more secure, such as corporate LANs. It is definitely not a panacea, not to mention that no large company, including Google, is able to implement it in full without incurring enormous costs. Third, whatever you do, it's extremely difficult to protect against an inside job. I'm not suggesting it was a case at all, I'm just saying it's better not to jump to conclusions too hastily.
- PLG88 5y agoAgreed, with a couple of caveats: - based on the perenial patch Tuesday issues I am surprised it did not happen sooner. - zero trust is a journey. we should accept that networks cannot be secure and instead look to implement principles of ZT away from the network. I like the open source OpenZiti project as a way to put strong identity and zt principles into our apps. Its not a panacea but it does make access and exploit much harder. - correct, though if using attribute-based access controls we can at least massively limit what an insider could get access to... 37GB of source code across multiple different project at first blush looks like more than what 1 single user should have access to.
- cute_boi 5y agoAnything interesting in this leak?
- jbverschoor 5y agoMicrosoft has been a supporter of open source lately anyway.
- ushakov 5y agono sane org would touch this with a 10 foot pole
- Spivak 5y agoBut with some clean room due diligence this could be a boon to WINE.
- mschuster91 5y agoThere have been a lot of leaks over the years. W2K and NT4 got leaked in 2004, XP in 2020 [1], and that's just the publicly known leaks where stuff ended on the 'chan boards or torrent sites. It's more than likely that there have been more leaks (e.g. from one of the academia or government audit programs) that have never been widely dispersed. And yet, both WINE and ReactOS have refused to use the leaks; ReactOS doesn't even allow people who have worked legitimately at MS in the past to be developers, simply because even the smell of contamination would expose the projects to enormous legal risks. The only way I could imagine these leaks being useful is by "parallel construction" aka by comparing the source code with actual Windows binaries and then the WINE/ReactOS code to spot out differences to check, and then have a second person investigate the differences with only the note "check function XYZ with implementation in current Windows binary". But that's a lot of effort for very low reward, not to mention you'd need at least two very skilled experts and the low-hanging fruits having been picked already long ago. [1] https://borncity.com/win/2020/10/01/entwickler-compiliert-windows-xp-2003-quellcode-aus-leak/ https://borncity.com/win/2020/10/01/entwickler-compiliert-wi... [2] https://reactos.org/forum/viewtopic.php?t=20189 https://reactos.org/forum/viewtopic.php?t=20189
- deleted 5y ago[deleted]
- skilled 5y agoSooo, are all of these leaks directly tied to the Okta access they had? That’s an absolute bummer for business if so. Sheesh.
- ushakov 5y agono, the leaks are separate
- gurjeet 5y agoOh no, what have I done! I hope you're not referring to my comment here [1]. Please note, that was, and remains, purely a speculation/hypothesis; see the thread after that. I have no knowledge, firsthand or otherwise, of them exploiting people's build systems. [1]: https://news.ycombinator.com/item?id=30763269 https://news.ycombinator.com/item?id=30763269
- wiz21c 5y ago> I have no knowledge, firsthand or otherwise Sus !
- hanselot 5y ago
- petepete 5y agoSo 37GB of source code is clearly a lot, but for someone unenlightened what kind of size are we looking at for the bigger projects? For example, Windows, Office, Exchange.
- thepill 5y agohttps://devblogs.microsoft.com/bharry/the-largest-git-repo-on-the-planet/ https://devblogs.microsoft.com/bharry/the-largest-git-repo-o...
- realmod 5y agoInteresting. Presumably, LAPSUS had access to Windows source code but still decided to go after comparatively low-fruit like Bing and Cortana instead of the digital gold that is Windows.
- thematrixturtle 5y agoI think you misspelled "dumpster fire". Microsoft is known for going to extreme lengths to maintain backward compatibility, but for Windows in particular this means code that's been hacked on for decades.
- kwccoin 5y agoWhilst it might be treasure for hacker, but for "learner" could I say any Windows are horrible precisely due to this baggage.
- traveler01 5y agoWindows source code must be huuuuge...
- Cthulhu_ 5y agoWasn't Windows' source code leaked a number of times already? I think Bing and Cortana will have some "algorithms" that might be worth a lot more for the right buyer. I mean Google's search algorithm is one of the best kept secrets in the industry.
- dirtylowprofile 5y agoAnything badass...
- captaincaveman 5y agoI don't want their compiled code let alone their source code!
- hutrdvnj 5y agoI could imagine a LibreWindows where all the bloatware, advertising, microsoft backdoors and so on are completely removed from the source.
- nivenkos 5y agoRussia is funding ReactOS.
- zozbot234 5y agoReactOS is not based on Microsoft source code. It's a clean-room reimplementation and anyone who has ever looked at Microsoft code is permanently banned from contributing to that project.
- hutrdvnj 5y agoHow do they know that their contributors never took a look at Microsoft source code?
- NullPrefix 5y agoHonor based system
- razakel 5y agoThis was a major factor in the Oracle v. Google case, where some of the argument boiled down to "well, how else would you do that?". ReactOS audited their code and showed that none of it was Microsoft's.
- lostgame 5y agoWith what money? :P
- tailspin2019 5y agoIf any of the hackers are here, could you run this on the Windows repo please? git reset --hard windows2000-sp4 /s
- _Algernon_ 5y agoMake it win 7 and I'd agree. (Actually I don't care anymore. Modern linux beats any version of windows in all my use cases)
- bezospen15 5y agoLol ok
- alunchbox 5y agoMake it vista and we're golden
- belltaco 5y agoNot sure if Vista was the low point or Windows ME. Probably Vista.
- sigg3 5y ago95 and 98 were horrible. Hearing the error chime still gives me physical reactions.
- _Algernon_ 5y agoWrong verb tense there. The low point is windows 11.
- fomine3 5y agoAgree. UAC is pretty basic feature.
- ComradePhil 5y ago> Modern linux beats any version of windows in all my use cases It's the other way around for me. Windows Subsystem for Linux ftw. I have used Linux as the primary Desktop OS for most of my life but I hope I will never have to go back ever again.
- petercooper 5y agoBecause I had a similar thought when Twitch's code "leaked" and I never got round to asking: is it illegal under US law to download such a leak for private inspection? That is, illegal in a way beyond copyright violation, such as being party to an act of espionage. (This leak doesn't interest me at all, but if ever the source for QBasic leaked, say.. well I might like to read it without becoming a wanted fugitive ;-))
- leeter 5y agoIANAL, the risk is generally not in the downloading per-se but the distribution and use. The copyright owner can sue for use or distribution of the IP. So you might be able to download and look but that would then basically prohibit you from making your own compatible QBasic interpreter. You're better off clean rooming it generally speaking. So it's basically poisoned, you can look but as soon as you do you can't touch anything to do with that area again until you can plausibly say you forgot everything you saw.
- Anunayj 5y agoSo this technically makes piracy legal, as losing as I'm not distributing the material, (or seeding it's torrent).
- monkeynotes 5y agoThis is the case in Canada, at least.
- Biganon 5y agoSwitzerland, too.
- leeter 5y agoIANAL, but no. You can still get sued.
- 5y ago
- hestefisk 5y agoDoes anyone actually use Cortana and Bing?
- ancode 5y agoBing and Cortana, the two most important and best working Microsoft products.
- q1w2 5y agoMy guess is that they did not leak Windows and Office source code because they want to mine it for 0days themselves. Time to really lock things down folks.
- denysvitali 5y agoOr simply because (as the screenshot show) they got only access to Azure for an account that doesn't have access to the OS department of Microsoft
- dustinmoris 5y agoThere is a reason why they hide that code ^^
- Seirdy 5y agoBing powers a host of other engines. Yahoo, DuckDuckGo, most of Qwant, AOL, the web results from Windows Search, Ecosia, and others are all dependent on Bing's search APIs. If you use a Google alternative, there's a good chance it's just Bing under the hood. So this leak could be a pretty big deal.
- retrocryptid 5y agocool. we can fix it now.
- bravetraveler 5y agoIt's crazy the leaking group is offering people who work at likely targets money. Like, what's the exit strategy there? They use your credentials, leak stuff, and you take the fall?