Microsoft Confirms Windows Code Leaked

Microsoft confirmed late Thursday that some of the secret code underlying its Windows NT and Windows 2000 operating systems has been leaked on the Internet. The company played down any potential security concerns the leak might cause.

Incomplete portions of Windows NT and Windows 2000 source code were "illegally made available on the Internet," according to Tom Pilla, a Microsoft spokesperson. Microsoft has no information on the source of the leak and has called in the FBI, he adds.

Microsoft has no indication that the leak is the result of any breach of the Microsoft corporate network or the company's internal security, Pilla says. Also, "at this point in time there is no known impact to customers," he says.

What's Out There?

Source code is pre-compiled code in the form of readable lines of text, usually with comments. It can be compiled into code that can run but can't be read. The Windows code on users' PCs is all compiled code.

A breach of the Windows source code--a mix of assembler, C and C++ code--could expose users to an increase in cyberattacks because it would make it easier for hackers to find holes in the operating systems that they can exploit. It would also mean that Microsoft's closely guarded intellectual property is now out in the open, says Joe Wilcox, a Washington, D.C.-based Jupiter Research senior analyst.

Those who say they have downloaded the source code claim to have a 200MB compressed file that expands into roughly 600MB of code. Microsoft officials told industry analysts that this is roughly correct and that it represents about 15 percent of Windows source code.

Online Chatter

Enthusiast Web sites earlier Thursday reported the code was leaked and had Microsoft scrambling to investigate the reports. The source code of the two operating systems was rumored to be available on a peer-to-peer file-sharing network as well as on Internet relay chat (IRC).

On Thursday afternoon, discussion sites and mailing lists were buzzing with chat about the leak. Some sites displayed screen shots or directly posted parts of what is said to be the source code.

IDG News Service was shown Web pages that appear to contain a directory listing of the packages of Windows 2000 and Windows NT source code. Experts say the listings represent source code for network protocols, parts of Internet Explorer, certificate handling, and the Windows kernel. Microsoft declines to confirm if that is correct.

Windows 2000 andWindows NT are older Microsoft products but are still widely used. The products also formed the basis of the current Windows XP operating system.

Similar Incident

In one posting on the Web site Slashdot.org, someone using the handle "Monkelectric" asked if the leak could be a ploy by Microsoft to get users to upgrade from Windows NT and Windows 2000 to newer operating systems, perhaps to avoid an onslaught of security breaches. Other posters joked about Windows having gone open source.

This is not the first time that Microsoft has faced a leak of its source code. In 2000, it confirmed that outsiders had accessed some of the code underlying a version of Windows as well as Office.

The company has offering controlled access to some of its source code through a program called the Shared Source Initiative. The program is meant for enterprise users, academics, and others.