Windows Source Leak Traces Back to Mainsoft (leaked from a Linux box - mine)

BetaNews ^ | Feb 13, 2004 | Nate Mook

[Leroy S. Mort]

EXCLUSIVE BetaNews has learned that Thursday's leak of the Windows 2000 source code originated not from Microsoft, but from long-time Redmond partner Mainsoft.

The leaked code includes 30,915 files and was apparently removed from a Linux computer used by Mainsoft for development purposes. Dated July 25, 2000, the source code represents Windows 2000 Service Pack 1.

Analysis indicates files within the leaked archive are only a subset of the Windows source code, which was licensed to Mainsoft for use in the company's MainWin product. MainWin utilizes the source to create native Unix versions of Windows applications.

Mainsoft says it has incorporated millions of lines of untouched Windows code into MainWin.

Clues to the source code's origin lie in a "core dump" file, which is left by the Linux operating system to record the memory a program is using when it crashes. Further investigation by BetaNews revealed the machine was likely used by Mainsoft's Director of Technology, Eyal Alaluf.

References to MainWin can also be found throughout the leaked source files, which do not compile into a usable form of Windows.

Prior to Microsoft's Shared Source Initiative launched in 2001, Mainsoft, which calls itself "the software porting company," was one of only two partners with access to the Windows source code under Microsoft's Windows Interface Source Environment (WISE) program.

The goal of WISE is to enable developers to write applications using Windows APIs and deploy them on Unix operating systems such as Linux.

Mainsoft extended its WISE agreement with Microsoft in March 2000 to include access to the Windows 2000 source. Microsoft subsequently employed Mainsoft to port Windows Media Player 6.3 and Internet Explorer to Unix.

Although the leak poses a serious threat to Microsoft's intellectual property, its limited scope is sure to help the company alleviate fears of potential disaster. Microsoft has opened an investigation with the FBI and says its internal security in Redmond was not affected.

Because Mainsoft used only select portions of the Windows source for MainWin, Microsoft may find itself more worried about the egg on its face than possible exposure of its flagship operating system; Windows 2000 served as the foundation for Windows XP and Windows Server 2003.

It is not clear at this point how the three and a half year-old source code escaped Mainsoft, but the company said it "will cooperate fully with Microsoft and all authorities in their investigation."

"Mainsoft has been a Microsoft partner since 1994, when we first entered a source code licensing agreement with Microsoft," a Mainsoft spokesperson told BetaNews. "Mainsoft takes Microsoft's and all our customers' security matters seriously, and we recognize the gravity of the situation. We are unable to issue any further statement or answer questions until we have more information."

Eric Steil and David Worthington contributed to this report.

[Leroy S. Mort]

The leaked code includes 30,915 files and was apparently removed from a Linux computer used by Mainsoft for development purposes.

Can't they get those darned Linux boxes secured?? (wry grin...)

[martin_fierro]

	Silicon Valley
Send FReepmail if you want on/off SVP list
Silicon Valley Slang

[beckett]

Statement form Mainsoft:

Statement to the Media Regarding Microsoft Source Code Leak

Mainsoft has been a Microsoft partner since 1994, when we first entered a source code licensing agreement with Microsoft. Mainsoft takes Microsoft’s and all our customers’ security matters seriously, and we recognize the gravity of the situation.

We will cooperate fully with Microsoft and all authorities in their investigation

We are unable to issue any further statement or answer questions until we have more information.

From Mike Gullard, Chairman of the Board, Mainsoft Corporation

[ßuddaßudd]

I beleive this incident is to inspire people to upgrade to Win XP.

[Glenn]

It is not clear at this point how the three and a half year-old source code escaped Mainsoft

Can't they get those darned Linux boxes secured?? (wry grin...)

I guess I'll wait for the facts.

[Tree of Liberty]

The kernel of Windows XP is virtually identical to Windows 2000. All of the primary changes were to the user interface. Therefore, there's a very good chance than an exploit found in the Win2k source code could also apply to WinXP.

[mikegi]

Back in the Win3x or Win95 development days, one developer always had his desktop machine's case removed and his hard drive laying out in the open. He had much of the Windows source tree on it. Anyway, he came in for work one morning and his HD was *gone* (it had been unplugged from a running machine). IIRC, the source never showed up online or anywhere else.

[ßuddaßudd]

Understood.

[Arkinsaw]

So this leaked from your linux box? Boy, are you in trouble.

[Snowy]

So this leaked from your linux box? Boy, are you in trouble.

Ok, what did Linus know and when did he know it?

[Leroy S. Mort]

So this leaked from your linux box? Boy, are you in trouble.

Never happen. All my Windows developer stuff is hard coded into Atari 800 cartridges and kept in a mayonnaise jar on Funk & Wagnalls porch.