Massive Windows 10 Core Source Code Leak Puts Redstone And ARM OneCore Builds At Risk
Well, this is not good. Chunks of source code related to internal Windows builds that have not yet been released to the general public were leaked online. According to The Register, a "massive treasure trove" totaling 32TB of official and non-public installation images and software blueprints was compressed down to 8TB and uploaded to BetaArchive.com, an online repository for beta software and what is known as abandonware.
Why this is potentially a big deal is because having access to source code—in this case, code that is normally closely guarded—allows hackers to look for vulnerabilities and then write exploits for them. According to the initial report, the leaked code was Microsoft's Shared Source Kit, which supposedly contains source to the base Windows 10 hardware drivers along with PnP code, USB and Wi-Fi stacks, storage drivers, and ARM-specific OneCore kernel code.
All of that information is intended for a select group of people, including Microsoft's engineers, its hardware partners, and other select customers who might need that information for whatever reason. Some of the code runs at the most trusted levels in Windows, which is not something you want falling into the wrong hands.
Should you be concerned? That is the big question right now and there is no clear answer. An admin at BetaArchive addressed the report and refuted the claim that it totaled 32TB.
"First of all let us clear up a few facts. The 'Shared Source Kit' folder did exist on the FTP until this article came to light. We have removed it from our FTP and listings pending further review just in case we missed something in our initial release. We currently have no plans to restore it until a full review of its contents is carried out and it is deemed acceptable under our rules," the admin wrote.
"The folder itself was 1.2GB in size, contained 12 releases each being 100MB. This is far from the claimed '32TB' as stated in The Register’s article, and cannot possibly cover 'core source code' as it would be simply too small, not to mention it is against our rules to store such data," the admin added.
BetaArchive surmised that the leak in question was ultimately related to a collection of Windows 10 builds that were uploaded by members of Microsoft's Windows Insider program. Those alone would not be cause for concern, since they are essentially easily attainable beta releases and defunct builds that have since been replaced by newer ones.
While the amount of leaked data is in dispute, a spokesman for Microsoft did confirm it contained bits of source code.
"Our review confirms that these files are actually a portion of the source code from the Shared Source Initiative and is used by OEMs and partners," Microsoft said.
The bottom line? Make sure your antivirus software is up to date and keep you system patched.
Why this is potentially a big deal is because having access to source code—in this case, code that is normally closely guarded—allows hackers to look for vulnerabilities and then write exploits for them. According to the initial report, the leaked code was Microsoft's Shared Source Kit, which supposedly contains source to the base Windows 10 hardware drivers along with PnP code, USB and Wi-Fi stacks, storage drivers, and ARM-specific OneCore kernel code.
Windows 10 leak: Beta Archive has removed the private MS files from its FTP. Here’s examples of non-public stuff that was dumped online pic.twitter.com/WULYM7me7U
— The Register (@TheRegister) June 23, 2017
Should you be concerned? That is the big question right now and there is no clear answer. An admin at BetaArchive addressed the report and refuted the claim that it totaled 32TB.
"First of all let us clear up a few facts. The 'Shared Source Kit' folder did exist on the FTP until this article came to light. We have removed it from our FTP and listings pending further review just in case we missed something in our initial release. We currently have no plans to restore it until a full review of its contents is carried out and it is deemed acceptable under our rules," the admin wrote.
"The folder itself was 1.2GB in size, contained 12 releases each being 100MB. This is far from the claimed '32TB' as stated in The Register’s article, and cannot possibly cover 'core source code' as it would be simply too small, not to mention it is against our rules to store such data," the admin added.
BetaArchive surmised that the leak in question was ultimately related to a collection of Windows 10 builds that were uploaded by members of Microsoft's Windows Insider program. Those alone would not be cause for concern, since they are essentially easily attainable beta releases and defunct builds that have since been replaced by newer ones.
While the amount of leaked data is in dispute, a spokesman for Microsoft did confirm it contained bits of source code.
"Our review confirms that these files are actually a portion of the source code from the Shared Source Initiative and is used by OEMs and partners," Microsoft said.
The bottom line? Make sure your antivirus software is up to date and keep you system patched.
