The distribution Thursday of portions of the secret programmer's instructions for two versions of the Windows operating system poses vexing legal and security challenges for Microsoft.
Computer security experts said on Friday that having even relatively small parts of the blueprints for Microsoft's Windows 2000 and Windows NT operating system as easily available reference material for potential vandals and troublemakers could complicate the company's already difficult task in securing its software.
Microsoft has been intensively criticized on security issues in recent years and the company has devoted increasing resources in an effort to restore its credibility with its customers.
The posting of the information on the Internet does not present any direct threat to the hundreds of millions of users of Microsoft's software, but it may fuel the fire among those who say that Microsoft, based in Redmond, Washington, has done a poor job of protecting computer users from hackers and invasions of viruses and worms. The company may also face a debate over its contention that the secrecy of its proprietary software offers a computer security advantage over the publicly available text of open-source programs like Linux.
Microsoft's executives said on Friday that they were working with federal law enforcement officials to attempt to understand how the software instructions, known as source code, had appeared on a variety of Internet peer-to-peer file sharing systems.
"We take this seriously," said Tom Pilla, a Microsoft spokesman. "It's illegal for third parties to post or make our source code available. From that standpoint we've taken appropriate legal action to protect our intellectual property."
Word of the theft of Microsoft's source code spread rapidly on Thursday afternoon after it was first reported on a Web site, Neowin.net, and then widely discussed on the Slashdot Web site, which is widely read by the nation's programming community.
By late Thursday evening dozens of copies of different text files ranging in size from 200 megabytes to one gigabyte were being downloaded by thousands of Internet users.
Computer programmers who examined the software instructions -- the basic texts from which the Windows operating systems programs are assembled -- reported that at least some versions of the program had come from a Microsoft partner, Mainsoft Corp, a software company whose headquarters are in San Jose, California.
Several computer security experts speculated that the Microsoft operating system source code had been stolen from a Mainsoft computer via the Internet and then posted on peer-to-peer file sharing networks.
Neither Microsoft nor Mainsoft would confirm this report. Mainsoft, however, released a statement acknowledging the firm had a source code licensing agreement with Microsoft.
"Mainsoft takes Microsoft's and all our customers' security matters seriously, and we recognize the gravity of the situation," Mike Gullard, chairman of Mainsoft, said in the statement. "We will cooperate fully with Microsoft and all authorities in their investigation."
Even though Windows 2000 and Windows NT are older versions of the company's operating systems, they are still widely used by corporations around the world.
"This raises real national security concerns," said William Cook, a partner at Wildman Harrold in Chicago and a former federal computer crime prosecutor. "The fact that Microsoft's software is so widely available will have an impact across the computer security industry."
A number of computer security and legal experts said that Microsoft's biggest challenge as a result of the incident may unfold in the future as skilled programmers begin to examine the texts in search of material that may be embarrassing or damaging to Microsoft.
"There have been lots of stories about the existence of undocumented features" in Microsoft's operating system that were intended to harm competitors, said Bruce Schneier, founder and chief technical officer of Counterpace Internet Security, a computer security firm in Mountain View, California.
In 1999, Microsoft suffered a black eye when a Canadian programmer, examining a portion of its software, discovered an element inside the company's Windows operating system labeled NSAKey. At the time, Microsoft said the reference was not an indication that the company was engaged in a conspiracy with the National Security Agency, a federal intelligence operation. The label, however, undercut the company's credibility within the computer security community, where it was widely criticized at the time. In addition to the NSAKey incident, the Diebold Corp, a manufacturer of automated teller and voting machines faced criticism after the programmers' instructions for its voting machines were circulated on the Internet. Technical experts said the code revealed flaws that might make the machines vulnerable to manipulation, a charge that Diebold denied.
A number of computer experts said that Microsoft had no choice but to rush to court to try to limit the spread of the software instructions through temporary restraining orders.
"The horse is out of the barn," said Jim Brelsford, a partner at the law firm Jones Day in Menlo Park, California. "But you have to do this to protect your trade secrets."
LEVERAGE: China did not ‘need to fire a shot’ to deny Taiwan airspace over Africa when it owns ‘half the continent’s debt,’ a US official said, calling it economic warfare The EU has raised concerns about overflight rights following the delay of President William Lai’s (賴清德) planned state visit to the Kingdom of Eswatini after three African nations denied overflight clearance for his charter at the last minute. Taiwanese allies Paraguay and Saint Kitts and Nevis, as well as several US lawmakers and the Inter-Parliamentary Alliance on China (IPAC) condemned China for allegedly pressuring the countries. Lai was scheduled to fly directly to Taiwan’s only African ally from yesterday to Sunday to celebrate the 40th anniversary of King Mswati III’s accession and his 58th birthday, but Seychelles, Mauritius and Madagascar suddenly revoked
The final batch of 28 M1A2T Abrams tanks purchased from the US arrived at Taipei Port last night and were transported to the Armor Training Command in Hsinchu County’s Hukou Township (湖口), completing the military’s multi-year procurement of 108 of the tanks. Starting at 12:10am today, reporters observed more than a dozen civilian flatbed trailers departing from Taipei Port, each carrying an M1A2T tank covered with black waterproof tarps. Escorted by military vehicles, the convoy traveled via the West Coast Expressway to the Armor Training Command, with police implementing traffic control. The army operates about 1,000 tanks, including CM-11 Brave Tiger
China on Wednesday teased in a video an aircraft carrier that could be its fourth, and the first using nuclear power, while making an allusion to Taiwan and vowing to further build up its islands, as it looks to boost maritime power, secure resources and bolster territorial claims. The video, issued on the eve of the 77th founding anniversary of the Chinese People’s Liberation Army Navy, featured fictional officers with names that are homophones of three commissioned aircraft carriers, the Liaoning (遼寧), Shandong (山東) and Fujian (福建). Titled Into the Deep, it showed a 19-year-old named “Hejian” (何劍) joining the group, sparking
BIG YEAR: The company said it would also release its A12 chip the same year to keep a ‘reliable stream of new silicon technologies’ flowing to its customers Taiwan Semiconductor Manufacturing Co (TSMC, 台積電) yesterday said its newest A13 chip is to enter volume production in 2029 as the chipmaker seeks to hold onto its tech leadership and demand for next-generation chips used in artificial intelligence (AI), high-performance-computing (HPC) and mobile applications. TSMC, the world’s biggest contract chipmaker, also unveiled its A12 chip at its annual technology symposium in Santa Clara, California. The A12 chip, which features TSMC’s super-power-rail technology to provide backside power delivery for AI and HPC applications, is also to enter volume production in 2029, a year after the scheduled release of the A14 chip. The technology moves
RSS