Onderwerp: W2K source "leaked"?

A couple of days ago a friend of mine drew my attention to the source
making rounds on the encrypted p2p networks, I was hoping it would take
a bit longer for it to be "out", but that was just day-dreaming.

Thor Larholm just gave me this URL, as you can notice, the server is busy:
http://www.neowin.net/comments.php?id=17509

I never believed in 0-days. "New" or more to the point
un-known-to-the-public exploits and vulnerabilities exist and are being
used.
In my opinion "0-days" virtually don't exist. It's usually either some
vulnerability that is long known and a COP or a worm is created. Or
exploits that will nearly never see the "public" but exist and are used
by few individuals.. but now... I don't know.

How often does a brand new exploit come out without prior warning and
"attack" the net?

*If* this really is the.. _real_ source code for W2K (and according to
the article NT4 as well).... we'll see what happens next.

People didn't need help finding vulnerabilities in Windows before, but
it just became a whole lot easier and a lot less demanding on the "m4d
#4x0r 5k111z".

I can't really say that the article is right and the source was "leaked"
or "stolen". The source is being sold/given (?) for years now to EDU's
and commercial companies for research purposes (not to mention China..).
I suppose foul play is always possible.

Can anyone confirm this is the real source code? How about a press
release?

Gadi Evron

=20

> -----Original Message-----
> From: Gadi Evron [mailto:ge@egotistical.reprehensible.net]=20
> Sent: Thursday, February 12, 2004 1:49 PM
> To: bugtraq@securityfocus.com
> Cc: full-disclosure@lists.netsys.com; Thor Larholm
> Subject: W2K source "leaked"?
>=20
> A couple of days ago a friend of mine drew my attention to the source
> making rounds on the encrypted p2p networks, I was hoping it=20
> would take
> a bit longer for it to be "out", but that was just day-dreaming.
>=20
> Thor Larholm just gave me this URL, as you can notice, the=20
> server is busy:
> http://www.neowin.net/comments.php?id=3D17509
>=20
> I never believed in 0-days. "New" or more to the point
> un-known-to-the-public exploits and vulnerabilities exist and=20
> are being
> used.
> In my opinion "0-days" virtually don't exist. It's usually either some
> vulnerability that is long known and a COP or a worm is created. Or
> exploits that will nearly never see the "public" but exist=20
> and are used
> by few individuals.. but now... I don't know.
>=20
> How often does a brand new exploit come out without prior warning and
> "attack" the net?
>=20
> *If* this really is the.. _real_ source code for W2K (and according to
> the article NT4 as well).... we'll see what happens next.
>=20
> People didn't need help finding vulnerabilities in Windows before, but
> it just became a whole lot easier and a lot less demanding on the "m4d
> #4x0r 5k111z".

This assumption reveals a lot about the merits of open source, doesn't
it.

Why should any of this be surprising to anyone? Haven't we all seen how
screeners make it onto the net, even screeners sent to eighty something
old Oscar judges? So, of course someone leaked this. It would have
happened sooner or later.

As for your comments on zero day, I have some strong opinions on that:

First, I recall two massive zero day exploits being used last year. One
in IE being used by spammers and one in IIS.

We should expect this trend to advance exponentially, I would think,
just considering the amount of people coming online, the natural
progression of security, the infiltration time required for the market
to meet the demand and such other natural factors.=20

Read: organized crime, corrupt governments and corporations and such...
have yet to really understand the unorthodox ways of bugfinding or the
power of the field. But that they will... That is simply a force of
nature. It is inevitable.=20

We should prepare for this now.

But, like most events similar to this in history, we won't. Or, we won't
do a very good job of it. Maybe others are more optimistic.


>=20
> I can't really say that the article is right and the source=20
> was "leaked"
> or "stolen". The source is being sold/given (?) for years now to EDU's
> and commercial companies for research purposes (not to=20
> mention China..).
> I suppose foul play is always possible.
>=20
> Can anyone confirm this is the real source code? How about a press
> release?
>=20
> Gadi Evron
>=20
>=20
>=20

Check this out

http://heim.ifi.uio.no/~mortehu/files.txt

This seem the dir of the Windows source code, I dont know if it a hoax.

And here is a torrent where it seem to be the source
http://www.skittlebrau.org/ring0_src.tar.bz2.torrent

This is all the information I have until now

Regards

On Thu, 12 Feb 2004 13:59:22 -0800
<tlarholm@pivx.com> wrote:

> This is not the first time that people have reported leaked copies of
> Windows source code. In 2000, Wired News reported that the source code
> for Whistler (now Windows XP) had been leaked, though they never
> confirmed it.
>
> http://www.wired.com/news/business/0,1367,35135,00.html
>
> WinBeta is also reporting on the new leak
>
> http://www.winbeta.org/winbeta/forum...2663&st=0&#ent
> ry9449
>
> 0-day exploits being used on Microsofts network, foul play by privileged
> partners or a hoax? Let's see what Microsoft reports.
>
>
>
> Regards
>
> Thor Larholm
> Senior Security Researcher
> PivX Solutions
> 24 Corporate Plaza #180
> Newport Beach, CA 92660
> http://www.pivx.com
> thor@pivx.com
> Phone: +1 (949) 231-8496
> PGP: 0x5A276569
> 6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569
>
> PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of
> Qwik-Fix
> <http://www.qwik-fix.net>
>
>
> -----Original Message-----
> From: Gadi Evron [mailto:ge@egotistical.reprehensible.net]
> Sent: Thursday, February 12, 2004 1:49 PM
> To: bugtraq@securityfocus.com
> Cc: full-disclosure@lists.netsys.com; Thor Larholm
> Subject: W2K source "leaked"?
>
>
> A couple of days ago a friend of mine drew my attention to the source
> making rounds on the encrypted p2p networks, I was hoping it would take
> a bit longer for it to be "out", but that was just day-dreaming.
>
> Thor Larholm just gave me this URL, as you can notice, the server is
> busy: http://www.neowin.net/comments.php?id=17509
>
> I never believed in 0-days. "New" or more to the point
> un-known-to-the-public exploits and vulnerabilities exist and are being
> used.
> In my opinion "0-days" virtually don't exist. It's usually either some
> vulnerability that is long known and a COP or a worm is created. Or
> exploits that will nearly never see the "public" but exist and are used
> by few individuals.. but now... I don't know.
>
> How often does a brand new exploit come out without prior warning and
> "attack" the net?
>
> *If* this really is the.. _real_ source code for W2K (and according to
> the article NT4 as well).... we'll see what happens next.
>
> People didn't need help finding vulnerabilities in Windows before, but
> it just became a whole lot easier and a lot less demanding on the "m4d
> #4x0r 5k111z".
>
> I can't really say that the article is right and the source was "leaked"
>
> or "stolen". The source is being sold/given (?) for years now to EDU's
> and commercial companies for research purposes (not to mention China..).
>
> I suppose foul play is always possible.
>
> Can anyone confirm this is the real source code? How about a press
> release?
>
> Gadi Evron
>


--
============================
it's so easy to forget me

dont blame me... the ring0_src is the linux kernel ... sorry about that

Check this out

http://heim.ifi.uio.no/~mortehu/files.txt

This seem the dir of the Windows source code, I dont know if it a hoax.

And here is a torrent where it seem to be the source
http://www.skittlebrau.org/ring0_src.tar.bz2.torrent

This is all the information I have until now

Regards

On Thu, 12 Feb 2004 13:59:22 -0800
<tlarholm@pivx.com> wrote:

> This is not the first time that people have reported leaked copies of
> Windows source code. In 2000, Wired News reported that the source code
> for Whistler (now Windows XP) had been leaked, though they never
> confirmed it.
>
> http://www.wired.com/news/business/0,1367,35135,00.html
>
> WinBeta is also reporting on the new leak
>
> http://www.winbeta.org/winbeta/forum...2663&st=0&#ent
> ry9449
>
> 0-day exploits being used on Microsofts network, foul play by privileged
> partners or a hoax? Let's see what Microsoft reports.
>
>
>
> Regards
>
> Thor Larholm
> Senior Security Researcher
> PivX Solutions
> 24 Corporate Plaza #180
> Newport Beach, CA 92660
> http://www.pivx.com
> thor@pivx.com
> Phone: +1 (949) 231-8496
> PGP: 0x5A276569
> 6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569
>
> PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of
> Qwik-Fix
> <http://www.qwik-fix.net>
>
>
> -----Original Message-----
> From: Gadi Evron [mailto:ge@egotistical.reprehensible.net]
> Sent: Thursday, February 12, 2004 1:49 PM
> To: bugtraq@securityfocus.com
> Cc: full-disclosure@lists.netsys.com; Thor Larholm
> Subject: W2K source "leaked"?
>
>
> A couple of days ago a friend of mine drew my attention to the source
> making rounds on the encrypted p2p networks, I was hoping it would take
> a bit longer for it to be "out", but that was just day-dreaming.
>
> Thor Larholm just gave me this URL, as you can notice, the server is
> busy: http://www.neowin.net/comments.php?id=17509
>
> I never believed in 0-days. "New" or more to the point
> un-known-to-the-public exploits and vulnerabilities exist and are being
> used.
> In my opinion "0-days" virtually don't exist. It's usually either some
> vulnerability that is long known and a COP or a worm is created. Or
> exploits that will nearly never see the "public" but exist and are used
> by few individuals.. but now... I don't know.
>
> How often does a brand new exploit come out without prior warning and
> "attack" the net?
>
> *If* this really is the.. _real_ source code for W2K (and according to
> the article NT4 as well).... we'll see what happens next.
>
> People didn't need help finding vulnerabilities in Windows before, but
> it just became a whole lot easier and a lot less demanding on the "m4d
> #4x0r 5k111z".
>
> I can't really say that the article is right and the source was "leaked"
>
> or "stolen". The source is being sold/given (?) for years now to EDU's
> and commercial companies for research purposes (not to mention China..).
>
> I suppose foul play is always possible.
>
> Can anyone confirm this is the real source code? How about a press
> release?
>
> Gadi Evron
>


--
============================
it's so easy to forget me

In-Reply-To: <8B32EDC90D8F4E4AB40918883281874D273FEE@pivxwin2k1 .secnet.pivx.com>

http://www.eweek.com/article2/0,4149...119TX1K0000594

and

http://www.eweek.com/article2/0,4149...119TX1K0000594

Microsoft has confirmed the leak. See the link below:
http://www.microsoft.com/presspass/p...dowssource.asp

Zhenkai

On Thu, 12 Feb 2004, Gadi Evron wrote:

> A couple of days ago a friend of mine drew my attention to the source
> making rounds on the encrypted p2p networks, I was hoping it would take
> a bit longer for it to be "out", but that was just day-dreaming.
>
> Thor Larholm just gave me this URL, as you can notice, the server is busy:
> http://www.neowin.net/comments.php?id=17509
>
> I never believed in 0-days. "New" or more to the point
> un-known-to-the-public exploits and vulnerabilities exist and are being
> used.
> In my opinion "0-days" virtually don't exist. It's usually either some
> vulnerability that is long known and a COP or a worm is created. Or
> exploits that will nearly never see the "public" but exist and are used
> by few individuals.. but now... I don't know.
>
> How often does a brand new exploit come out without prior warning and
> "attack" the net?
>
> *If* this really is the.. _real_ source code for W2K (and according to
> the article NT4 as well).... we'll see what happens next.
>
> People didn't need help finding vulnerabilities in Windows before, but
> it just became a whole lot easier and a lot less demanding on the "m4d
> #4x0r 5k111z".
>
> I can't really say that the article is right and the source was "leaked"
> or "stolen". The source is being sold/given (?) for years now to EDU's
> and commercial companies for research purposes (not to mention China..).
> I suppose foul play is always possible.
>
> Can anyone confirm this is the real source code? How about a press
> release?
>
> Gadi Evron
>
>