We saw it on Twitter. What about you?
pic.twitter.com/aNYt07qKsI
– DI! (@RoninDey) 24. September 2020
According to reports, someone has just revealed a mega-intrusion (pun – some of the files would also have been uploaded to the Kiwi Mega File Exchange Service) on Microsoft’s source code up to MS-DOS 6.
The enlargement of the image in the tweet above shows some interesting artifacts:
OS by file name Estimated source size (bytes)
——————— —————————
MS-DOS 6 10 600 000
NT 3,5 101 700 000
NT 4 106 200 000
Windows 2000 122 300 000
NT 5 2 360 000 000 000
Take these figures with a pinch of salt, of course – it’s not just these stolen plates, we can’t tell you how complete they are, or that they can be compared at all.
NT 5, for example, includes a number of Windows flavors officially listed by Microsoft, as shown below. It is therefore likely that the NT 5 archive contains everything that is already included in the Windows 2000 archive presented above, and much more:
Operating system name Version
————————— ————–
Windows 2000 5.0
Windows XP 5.1
Windows XP 64-Bit Edition 5.2
Windows Server 2003 5.2
Windows Server 2003 R2 5.2
In case you’re wondering: Vista was 6.0 and Microsoft stayed at 6.x for Server 2008, Server 2012 and even, oddly enough, for the versions known externally digitally as Windows 7 and 8.
Of course there was no Windows 9, although we never knew why, and with Windows 10 the version number made a logical jump to version 10.0 to match the product name. (Servers 2016 and 2019 are also considered version 10.0).
It is interesting to note that Microsoft officially released old-school sources earlier, for example when MS-DOS 1.25 (1982) and Word 1.1a (1984) were released a few years ago.
And in recent years, the company has officially and enthusiastically adopted open source code for a number of its projects, where you not only show people your code, but also allow them to use it freely.
But as far as we know there has never been a complete and public dump of Windows XP sources.
What does this mean?
There are rumours that a lot, if not most, of this code has been circulating silently in underground forums for years.
Of course, it seems unlikely that a lone hacker could acquire all these files at once, directly from a previously unknown archive from his mother’s vein at Microsoft itself.
But as far as we know, this is the first declared source code for Windows XP that appeared under the name Megadump-All-in-One.
(There are rumors that when you try to compile the 64-bit version of XP, you may encounter errors due to missing files, so the archive may already be incomplete).
So is this leak a security disaster that will inevitably lead to many new exploits using the XP bugs that are still present in the current versions of Windows?
Or is it just the most innocent, if not the most illegal, opportunity to take a trip back in time, provided you have the time, desire and bandwidth to roll gigabytes of stolen waste?
We think it’s pretty much the last one.
Since other things are the same, serious security holes are easier to find if you have commented on the source code for you and the compiled binaries.
Indeed, if you’re looking for errors such as buffer overflows, hanging pointers (which free up memory but keep using it even after they’ve been passed on to someone else), whole arithmetic errors, or cryptographic arithmetic errors, then you should keep looking.
Sometimes comments alone can help to magnify the problematic code, especially if you come across fragments where the programmer has left reminders such as /* FIX ME! */ or // asked the original author, but can’t remember if it ever worked properly.
However, experienced bug hunters can find vulnerabilities and exploits without resorting to source code, as the number of bugs fixed each month in products like Windows and closed components of MacOS, iOS and Android reminds us only too well.
Although hidden bugs in XP are sometimes transferred to current versions of Windows, these bugs are being exploited less and less as a result of major security changes in the Windows kernel.
For example, before Windows XP Service Pack 3, almost all buffer stack overflow vulnerabilities that could be found in a popular Windows application were sufficient to create an exploit.
No measures have been taken to prevent the release of data, no address space has been randomised and there are virtually no other measures to limit the buffering effects on the white area.
If you could overwrite the return address of the current function, you would have more than one way to interrupt a running program – you could also convert the error to a runtime operation for remote code execution.
What should I do?
If you are interested in programming, cybersecurity or the history of technology, or if you are just curious about what Microsoft programmers have to say about the more carefree programming days of the early 21st century, you are in for a treat. century were inclined to write…..
…for a seductive look.
But if you really need to see it, we suggest you drop it, especially if your interest is fleeting and random.
I mean, you won’t be able to see the code after you look at it.
And if you ever get into a situation where you have to show that you can’t copy someone else’s code, even if you wanted to, it would be harder for you if the other party could show that you’re looking at it.
Oh, and if you’re a programmer, even if you’re only working on your own texts that you think will remain a trade secret forever, don’t forget that your texts are a bit like a professional CV:
- Don’t be careless.
- Tell me what you mean.
- Whatever you say.
- You shouldn’t be as spiritual as you think you are.
First of all, you’ll write better code if you follow these rules.
Secondly, these remarks, which seemed so sharp and funny at the time, may not be as old as you thought.
Write your code like your mother sees it and make sure she needs it.
Because, as far as you know, she can do both.
Related Tags:
windows xp leak 4chan,windows xp source code github,windows xp source code download,4chan source code,ntdev,microsoft leaked source code archive download
