About Us | Contact Us
View Cart

When You Accidentally Go Open Source

By Vigilize | Monday, July 24, 2017 - Leave a Comment

32 TB of Windows 10-related source code is now available, for better or for worse…


An article review.


ServIcons_ITAudit_01Releasing the source code for a project has been a common practice among some developers for decades now–proponents say allowing any interested parties to view the code makes for safer systems, preventing sneaky back doors and unintentional bugs alike.

Microsoft however has historically not embraced this kind of philosophy, preferring to keep the source code to their products closed to preserve secrecy…until this month, when a 32 TB archive of Windows 10 source code was uploaded to a site specializing in beta versions of old software. The archive was quickly pulled, however we all know nothing is truly ever gone once it has been uploaded to the internet, so it can be assumed this source code is now out in the wild.

In addition to Microsoft’s “Shared Source Kit,” internal testing builds of Windows 10 containing special debugging tools were included in the leak, allowing interested parties to perform testing on the operating system that otherwise would not be possible.

While the impact of this leak is hard to predict in advance, the availability of this code will certainly be of interest to security professionals and hackers alike. For example, code can be examined directly for cases where an error may allow for security privileges to be escalated, or where rare confluences of events could lead to unexpected behavior that can then be exploited. Typically such incidents must be stumbled upon through trial and error, but having the source code available gives interested parties a road map of sorts, allowing them to zero-in on areas of interest.

The upside to this news is that plenty of white hat, or ethical, hackers will be pouring over this same code–and their disclosure of any vulnerabilities that they may find could lead to Microsoft issuing security fixes for flaws before they’re found in the wild. With the code available, there wouldn’t even be anything to stop an enterprising programmer from making their own fixes…except for Microsoft’s legal department, of course.


Original article by Chris Williams.


same_strip_012513


 

Latest News
    As the investigation of the SolarWinds Hack was ongoing, another hack stole some of the limelight… This is the final update on the SolarWinds hack unless a major development comes to light. You can see the previous article here: “Autopsy of the SolarWinds Hack Update“. One of the largest cyber-espionage campaigns in the history of […]
    Employees working from home may find it more difficult to follow security policies… An article review. The surge in employees working from home during the pandemic created many headaches for IT departments around the world, many of whom had no telecommuting policies or procedures before the start… but what about the employees who had to […]
    A Webinar-Movie infotex presents the 2021 update of a previously released webinar presented by our Lead Non-Technical Auditor, Adam Reynolds. This movie-short is intended for those who are planning to participate in an infotex Incident Response Test. Not sure about the importance of an Incident Response Test? Check out onetest.infotex.com for more information! Please let […]
    PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS INFOTEX PROMOTES BRYAN BONNELL TO DIGITAL MEDIA MANAGER infotex, the Managed Security Service Provider, announced Bryan Bonnell’s promotion from Senior Data Security Analyst to Digital Media Manager.  “He will continue his normal DSA duties on a limited basis, because we want everybody to stay in touch with […]
    PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS RYAN HENSLER OF INFOTEX, EARNS CISSP CERTIFICATE Ryan Hensler, Senior NOC Associate of infotex, Inc., recently received the CISSP certification. “Ryan has proven himself to be a seasoned security professional both in his work for infotex and now through achieving this certification.” said Sean Waugh, Information Security Officer. […]
    Dubious app store subscriptions bring in hundreds of millions of dollars in revenue… An article review. When it comes to malicious applications you’re probably familiar with things like malware and ransomware, and you have ways to avoid them.  Modern desktop and smartphone operating systems have built-in malware detection tools, and some web browsers even automatically […]
    Another Manifesto A supply-chain manifesto by the author of Never Say Never: A Password Manifesto! Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . [Sssshh.  Turn out the lights.  Let’s lower our inner voices, as I have something to propose that might be a bit […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office.  
    While malware and security exploits continue to make headlines, the majority of reported security incidents involve phishing… An article review. With all the attention given recently to security incidents involving software exploits and high-profile malware attacks, it would be easy to believe that they represented the most likely incidents you may encounter in the wild.  […]
    Implementing Protective DNS could help your organization avoid attack… An article review. Noting the risks still associated with the Domain Name System (DNS), the National Security Agency and the Cybersecurity and Infrastructure Security Agency (CISA) have recently released new guidance on the selection and use of a Protective DNS service (PDNS). The guidance, released in […]