Source Code for Windows XP, 2003, and More Leaked

What happened?

If you trust the Internet, the story goes like this: a leaker, that goes by the handle billgates3, amassed the treasure trove of Microsoft source code over a period of months leading up to this weekend, and felt that releasing it was in the best interest of the public since, after all, this code has been circulating the underground hacker world for years. The code was shared on 4chan, an image-based BBS, and the link was archived after being live for just four hours.

Various media outlets have received the same response from Microsoft to their inquiries, "We are investigating the matter.” (Tom'sHardware.com)

Some Background

Microsoft’s Government Security Program provides controlled access to information for eligible organizations. Its existence is not evidence of the source of a leak or proof that attackers possessed code for years.

Microsoft Source Code Leaked via Torrent

What's the Big Deal?

Source-code exposure may assist analysis, but a reported leak does not establish a specific exploitable vulnerability. Treat the September 2020 reports as historical and distinguish confirmed facts from speculation.

What's at Risk?

The potential issues that could arise from this will most probably target the operating systems released in the torrent:

• Windows 2000
• Windows CE 3
• Windows CE 4
• Windows CE 5
• Windows Embedded 7
• Windows Embedded CE
• Windows NT 3.5
• Windows NT 4
• MS-DOS 3.30
• MS-DOS 6.0

Though it's worth noting that software developers frequently re-use code and newer operating systems may be vulnerable to some of the same attacks that stem from this leak.

Do not assume a regular patching cadence guarantees safety or that an attacker will not target your organization. Retire unsupported systems and evaluate unavoidable legacy dependencies explicitly.

So What Should I Do?

Well this may not come as a surprise, but here we go anyway: Get your environment off any of the aforementioned operating systems ASAP! These operating systems are all end-of-life and should not be running production workloads anywhere in your environment. End-of-life typically means any new exploits that affect these systems will not be patched by Microsoft.

Additionally, revisit your patching process to ensure that your patch management cadence is complete (includes all systems) and timely. If anything comes from this that affects currently supported operating systems, prompt patching will be critical.