RE: [Full-Disclosure] RE: W2K source "leaked"?

[Andre Ludwig]

I am still up in the air on if this is legit or not. If it is yes the bar
has been lowered for simple exploits. It will also have the effect of
empowering those skilled individuals into creative and more advanced attacks
and exploits against the windows platform. From the source file listings
floating around on the net it looks legit, but i doubt it is the entire
source tree most likely a branch or two. Been told that the .zip file is
only 300 mb or so compressed. Which is no where near the size of the
reported win2k source tree (50gb or so) as reported here.

http://www.usenix.org/events/usenix-win2000/invitedtalks/lucovsky_html/sld01
5.htm

Andre Ludwig CISSP



-----Original Message-----
From: tlarholm@pivx.com [mailto:tlarholm@pivx.com]
Sent: Thursday, February 12, 2004 1:59 PM
To: ge@egotistical.reprehensible.net; bugtraq@securityfocus.com
Cc: full-disclosure@lists.netsys.com
Subject: [Full-Disclosure] RE: W2K source "leaked"?


This is not the first time that people have reported leaked copies of
Windows source code. In 2000, Wired News reported that the source code
for Whistler (now Windows XP) had been leaked, though they never
confirmed it.

http://www.wired.com/news/business/0,1367,35135,00.html

WinBeta is also reporting on the new leak

http://www.winbeta.org/winbeta/forums/index.php?showtopic=2663&st=0&#ent
ry9449

0-day exploits being used on Microsofts network, foul play by privileged
partners or a hoax? Let's see what Microsoft reports.



Regards

Thor Larholm
Senior Security Researcher
PivX Solutions
24 Corporate Plaza #180
Newport Beach, CA 92660
http://www.pivx.com
thor@pivx.com
Phone: +1 (949) 231-8496
PGP: 0x5A276569
6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569

PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of
Qwik-Fix
<http://www.qwik-fix.net>


-----Original Message-----
From: Gadi Evron [mailto:ge@egotistical.reprehensible.net]
Sent: Thursday, February 12, 2004 1:49 PM
To: bugtraq@securityfocus.com
Cc: full-disclosure@lists.netsys.com; Thor Larholm
Subject: W2K source "leaked"?


A couple of days ago a friend of mine drew my attention to the source
making rounds on the encrypted p2p networks, I was hoping it would take
a bit longer for it to be "out", but that was just day-dreaming.

Thor Larholm just gave me this URL, as you can notice, the server is
busy: http://www.neowin.net/comments.php?id=17509

I never believed in 0-days. "New" or more to the point
un-known-to-the-public exploits and vulnerabilities exist and are being
used.
In my opinion "0-days" virtually don't exist. It's usually either some
vulnerability that is long known and a COP or a worm is created. Or
exploits that will nearly never see the "public" but exist and are used
by few individuals.. but now... I don't know.

How often does a brand new exploit come out without prior warning and
"attack" the net?

*If* this really is the.. _real_ source code for W2K (and according to
the article NT4 as well).... we'll see what happens next.

People didn't need help finding vulnerabilities in Windows before, but
it just became a whole lot easier and a lot less demanding on the "m4d
#4x0r 5k111z".

I can't really say that the article is right and the source was "leaked"

or "stolen". The source is being sold/given (?) for years now to EDU's
and commercial companies for research purposes (not to mention China..).

I suppose foul play is always possible.

Can anyone confirm this is the real source code? How about a press
release? :)

Gadi Evron

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

[Drew Copley]

=20

> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com=20
> [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of=20
> Gadi Evron
> Sent: Friday, February 13, 2004 9:51 AM
> To: Drew Copley
> Cc: bugtraq@securityfocus.com; full-disclosure@lists.netsys.com
> Subject: [Full-Disclosure] Re: W2K source "leaked"?
>=20
> > As for your comments on zero day, I have some strong=20
> opinions on that:
> >
> > First, I recall two massive zero day exploits being used=20
> last year. One
> > in IE being used by spammers and one in IIS.
>=20
> Two out of how many?

It is true that there are exploits which can go under the radar.=20

I have a lot of fascination for these.=20

Customers can't report to AV or security companies trojans they never
even knew they had.

The requirement level is high, however:

-> Finding a substantial Window's bug is difficult. Usually. It isn't
black magic, but it isn't well documented and requires a substantial
amount of effort.
-> There is a huge demand to just release the bug to the public through
Full Disclosure
-> traditional trojan models have the trojan listening on a port, always
active... This can mean it could crash or otherwise reveal itself to the
end user. Magnify the end user pool and you so magnify the chance for an
unknown error to reveal itself. Especially across different locale
systems.
-> One needs to take care of erasing the tracks back and forth to the
system. This would mean that one would have to communicate with the
trojan in a way that would be imperceptible to all of the 'radars'
people have out there (honeypots, sniffers, firewalls, ids')... The more
end users or "victims" or "targets" the larger the chance that this
communication would be seen
-> One would need to keep silent about all of this. This would rule out
most people. Except for professionals and true fanatics. Both the
fanatic and the professional would have to entirely resist the
temptation to brag about such an amazing feat. Human nature is strongly
propelled by the need for praise from men... Ego feeding. Forget food
and shelter. People want glory. So, you either have a loner or someone
really, really committed to their goal.=20
-> One would need to understand the target's AV, IDS and whatever other
system of protection or evidence gathering they might have in place.=20
-> If someone wants to just make a bunch of money by stealing online,
they don't have to have a new bug and they don't have to jump through
all of these hoops. So what if they are detected? By then they could
clean up shop already. It isn't like there is some kind of effective or
fast police force anywhere dealing with any of this. This is a huge
factor.




>=20
> >
> > We should expect this trend to advance exponentially, I would think,
> > just considering the amount of people coming online, the natural
> > progression of security, the infiltration time required for=20
> the market
> > to meet the demand and such other natural factors.
>=20
> That's the future, not the present. :)

A lot of security companies already plan for this. It isn't anything
new, to note this. But, it is just something a lot of people don't seem
to really think much of. There tends to be this idea that bugs just
mysteriously happen and are documented. But, there is a huge process
there. And, that process is largely not easy to duplicate. It requires
unorthodox thinking, which is not well suited to the regimented idealism
of corporate or governmental environments.

>=20
> >
> > Read: organized crime, corrupt governments and corporations=20
> and such...
> > have yet to really understand the unorthodox ways of=20
> bugfinding or the
> > power of the field. But that they will... That is simply a force of
> > nature. It is inevitable.
> >
>=20
> Why would organized crime (etc.) chose to make such exploits in their
> arsenal public?

I think you misunderstood me.

>=20
> > We should prepare for this now.
> >
> > But, like most events similar to this in history, we won't.=20
> Or, we won't
> > do a very good job of it. Maybe others are more optimistic.
> >
>=20
> Of course we will, after-the-fact. :)

Yep.

It is how law is enforced anywhere. Always has been. Reactive. Proactive
security is always a reaction. We are lazy. We require inertia. And, by
"history", I am - of course - speaking of information security history
and physical security history.=20

>=20
> Gadi Evron.
>=20
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>=20
>=20

I know some people have been talking about this as being a false news
story, but now there is confirmation from Redmond.

http://www.komotv.com/stories/29778.htm




Regards

Thor Larholm
Senior Security Researcher
PivX Solutions
24 Corporate Plaza #180
Newport Beach, CA 92660
http://www.pivx.com
thor@pivx.com
Phone: +1 (949) 231-8496
PGP: 0x5A276569
6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569

PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of
Qwik-Fix
<http://www.qwik-fix.net>=20



-----Original Message-----
From: Gadi Evron [mailto:ge@egotistical.reprehensible.net]=20
Sent: Thursday, February 12, 2004 1:49 PM
To: bugtraq@securityfocus.com
Cc: full-disclosure@lists.netsys.com; Thor Larholm
Subject: W2K source "leaked"?


A couple of days ago a friend of mine drew my attention to the source=20
making rounds on the encrypted p2p networks, I was hoping it would take=20
a bit longer for it to be "out", but that was just day-dreaming.

Thor Larholm just gave me this URL, as you can notice, the server is
busy: http://www.neowin.net/comments.php?id=3D17509

I never believed in 0-days. "New" or more to the point=20
un-known-to-the-public exploits and vulnerabilities exist and are being=20
used.
In my opinion "0-days" virtually don't exist. It's usually either some=20
vulnerability that is long known and a COP or a worm is created. Or=20
exploits that will nearly never see the "public" but exist and are used=20
by few individuals.. but now... I don't know.

How often does a brand new exploit come out without prior warning and
"attack" the net?

*If* this really is the.. _real_ source code for W2K (and according to=20
the article NT4 as well).... we'll see what happens next.

People didn't need help finding vulnerabilities in Windows before, but=20
it just became a whole lot easier and a lot less demanding on the "m4d=20
#4x0r 5k111z".

I can't really say that the article is right and the source was "leaked"

or "stolen". The source is being sold/given (?) for years now to EDU's=20
and commercial companies for research purposes (not to mention China..).

I suppose foul play is always possible.

Can anyone confirm this is the real source code? How about a press=20
release? :)

Gadi Evron

[LordInfidel@directionweb.com]

Just a thought:

Has anyone given any consideration that maybe this source is =
trojanized?

It's obviously pirated, since MS probably did not release it to the =
general
public.
(At least they have not made a public announcement to that effect, =
unless I
am mistaken
and that is always a possibility)

Not to mention, how are you going to guarantee it's validity? I can =
bet
there are no
official MS MD5 checksums to verify against what is contained in the
package.

Maybe we should step back for a second and take a closer look, apply =
some
rational reasoning, rather then getting caught up in the hype.

JMO

LordInfidel

-----Original Message-----
From: V=EDctor [mailto:ixnay@infonegocio.com]
Sent: Thursday, February 12, 2004 7:47 PM
To: tlarholm@pivx.com
Cc: ge@egotistical.reprehensible.net; bugtraq@securityfocus.com;
full-disclosure@lists.netsys.com
Subject: Re: W2K source "leaked"?


Check this out

http://heim.ifi.uio.no/~mortehu/files.txt=20

This seem the dir of the Windows source code, I dont know if it a hoax.

And here is a torrent where it seem to be the source
http://www.skittlebrau.org/ring0_src.tar.bz2.torrent

This is all the information I have until now

Regards

On Thu, 12 Feb 2004 13:59:22 -0800
<tlarholm@pivx.com> wrote:

> This is not the first time that people have reported leaked copies of
> Windows source code. In 2000, Wired News reported that the source =
code
> for Whistler (now Windows XP) had been leaked, though they never
> confirmed it.
>=20
> http://www.wired.com/news/business/0,1367,35135,00.html
>=20
> WinBeta is also reporting on the new leak
>=20
> =
http://www.winbeta.org/winbeta/forums/index.php?showtopic=3D2663&st=3D0&=
#ent
> ry9449
>=20
> 0-day exploits being used on Microsofts network, foul play by =
privileged
> partners or a hoax? Let's see what Microsoft reports.
>=20
>=20
>=20
> Regards
>=20
> Thor Larholm
> Senior Security Researcher
> PivX Solutions
> 24 Corporate Plaza #180
> Newport Beach, CA 92660
> http://www.pivx.com
> thor@pivx.com
> Phone: +1 (949) 231-8496
> PGP: 0x5A276569
> 6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569
>=20
> PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version =
of
> Qwik-Fix
> <http://www.qwik-fix.net>=20
>=20
>=20
> -----Original Message-----
> From: Gadi Evron [mailto:ge@egotistical.reprehensible.net]=20
> Sent: Thursday, February 12, 2004 1:49 PM
> To: bugtraq@securityfocus.com
> Cc: full-disclosure@lists.netsys.com; Thor Larholm
> Subject: W2K source "leaked"?
>=20
>=20
> A couple of days ago a friend of mine drew my attention to the source =

> making rounds on the encrypted p2p networks, I was hoping it would =
take=20
> a bit longer for it to be "out", but that was just day-dreaming.
>=20
> Thor Larholm just gave me this URL, as you can notice, the server is
> busy: http://www.neowin.net/comments.php?id=3D17509
>=20
> I never believed in 0-days. "New" or more to the point=20
> un-known-to-the-public exploits and vulnerabilities exist and are =
being=20
> used.
> In my opinion "0-days" virtually don't exist. It's usually either =
some=20
> vulnerability that is long known and a COP or a worm is created. Or=20
> exploits that will nearly never see the "public" but exist and are =
used=20
> by few individuals.. but now... I don't know.
>=20
> How often does a brand new exploit come out without prior warning and
> "attack" the net?
>=20
> *If* this really is the.. _real_ source code for W2K (and according =
to=20
> the article NT4 as well).... we'll see what happens next.
>=20
> People didn't need help finding vulnerabilities in Windows before, =
but=20
> it just became a whole lot easier and a lot less demanding on the =
"m4d=20
> #4x0r 5k111z".
>=20
> I can't really say that the article is right and the source was =
"leaked"
>=20
> or "stolen". The source is being sold/given (?) for years now to =
EDU's=20
> and commercial companies for research purposes (not to mention =
China..).
>=20
> I suppose foul play is always possible.
>=20
> Can anyone confirm this is the real source code? How about a press=20
> release? :)
>=20
> Gadi Evron
>=20


--=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D
it's so easy to forget me

[Nick FitzGerald]

"Drew Copley" <dcopley@eeye.com> wrote:

> It is true that there are exploits which can go under the radar.
>
> I have a lot of fascination for these.
>
> Customers can't report to AV or security companies trojans they never
> even knew they had.
>
> The requirement level is high, however:

Yep, but seldom as high as you suggest...

> -> Finding a substantial Window's bug is difficult. Usually. It isn't
> black magic, but it isn't well documented and requires a substantial
> amount of effort.
> -> There is a huge demand to just release the bug to the public through
> Full Disclosure

Or, skip all that palaver and recon your target carefully to determine:

1. What products inspect their incoming Email. Many sites helpfully
leak great scads of valuable information about virus and content
scanner products and versions used just from inspecting the headers of
messages from staff and from bounces. Most sites are even more helpful
if you send specially chosen attachments or specifically styled
messages as they will bounce messages back because they fail one or
other of their virus, spam and other content control filters which
usually cannot resist advertising their maker's products.

2. What products and versions they use for web browsing, Email, etc.

3. If the answers are Windows, IE, Outlook/OE and their virus and
content scanners are not heavily into exploit detection (many claim to
detect exploits but really only detect minor variations on the original
proof of concept code posted by Guninski, http-equiv, etc) then it
should be relatively easy to devise a variation on one of several
currently known exploits to get past the supposed "protection".

> -> traditional trojan models have the trojan listening on a port, always
> active... This can mean it could crash or otherwise reveal itself to the
> end user. Magnify the end user pool and you so magnify the chance for an
> unknown error to reveal itself. Especially across different locale
> systems.
> -> One needs to take care of erasing the tracks back and forth to the
> system. This would mean that one would have to communicate with the
> trojan in a way that would be imperceptible to all of the 'radars'
> people have out there (honeypots, sniffers, firewalls, ids')... The more
> end users or "victims" or "targets" the larger the chance that this
> communication would be seen
> -> One would need to keep silent about all of this. This would rule out
> most people. Except for professionals and true fanatics. Both the
> fanatic and the professional would have to entirely resist the
> temptation to brag about such an amazing feat. Human nature is strongly
> propelled by the need for praise from men... Ego feeding. Forget food
> and shelter. People want glory. So, you either have a loner or someone
> really, really committed to their goal.
> -> One would need to understand the target's AV, IDS and whatever other
> system of protection or evidence gathering they might have in place.

Those are all good points, and especially problematic to someone trying
to surreptitiously build up a bot army or similar. However, if the
object of the exercise is a directed attack by a competitor to steal
proprietary information (be that a listing of your sales database or
the source code of your next "market leading" app), or by organized
crime to get anything worth blackmailing you over (any proprietary data
they could sell to your competitors or any "dirt" -- "we hacked
<your_company_name> and here's the proof" where that kind of exposure
would be damaging to your business' reputation, most of those concerns
are greatly reduced as it only needs to be a one-time hit.

> -> If someone wants to just make a bunch of money by stealing online,
> they don't have to have a new bug and they don't have to jump through
> all of these hoops. So what if they are detected? By then they could
> clean up shop already. It isn't like there is some kind of effective or
> fast police force anywhere dealing with any of this. This is a huge
> factor.

Of course, and that is what the current skiddie fad of mass-
distribution of trivially new RAT variants is all about and why some
RATs target one or more of the the Sub7, Kuang and Mydoom networks to
distribute their RATs and other malware and so on. There are enough
na=EFve, gullible folk out there to get owned via these methods _AND_ who
aren't using AV that will detect the latest RAT variant either
initially or within a few days (after an update or two) or who aren't
using a firewall to block the outgoing connections, or who won't notice
for weeks or months that their AV and/or firewall has been disabled
(the first action of increasingly many of these kinds of things).

Because there is such an army of na=EFve users and because there is no
effective law enforcement interest in dealing with the perpetrators of
such "virtual crime" we will keep seeing this end of the market thrive
(most of the skiddies running their RAT generator kits don't even care
that most of the large AVs detect all their "new" variants generically
or heuristically, because they have long since realized that even just
focussing on hitting some portion of the userbase of folk who don't use
(up-to-date) AV is more than enough for most of them).

We've strayed some distance from what, if any, increased security
concerns there are as a result of the Windows source "leak"...


--
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854