Microsoft became aware that the source code – containing as much
as 15% of Windows 2000 and Windows NT 4.0, according to some
reports – had been illegally posted to the internet late last week
and circulated using file-sharing services.
The software giant immediately launched an internal
investigation and called in the FBI. Yesterday it claimed that the
leak was not the result of any breach of its internal security or
corporate network.
According to reports, investigations are now focusing on one of
Microsoft's partner companies, Mainsoft, a Silicon Valley developer
that needs access to the code to produce software for firms wanting
to run Unix versions of Windows software.
The reason for targeting Mainsoft appears to be that the company
is mentioned within the 205MB portion of leaked code that is
circulating the internet. However, it is only one of around 500,000
developers with access to parts of the code.
Mike Gullard, Mainsoft's Chairman, issued a brief statement
saying: "Mainsoft takes Microsoft's and all our customers' security
matters seriously, and we recognize the gravity of the situation.
We are cooperating fully with Microsoft and all authorities in
their investigation."
Experts are divided on the implications of the leak. Some speculate
that the code could help hackers exploit potential vulnerabilities
in those systems; others disagree, saying they don't need to code
to do this. But Microsoft is taking the matter very seriously.
The company said it is warning those that have already
downloaded the code that they are in breach of both copyright
legislation and laws protecting the code as a trade secret. It has
not said how it is identifying downloaders.
The company has also set up alerts on P2P networks where
file-sharing of the code has been taking place.
According to the company: "These alerts are designed to inform
any user who conducts specific searches on these networks to locate
and download the source code that such activity is illegal".
Tom Pilla, spokesman for Microsoft, told CNET News.com
yesterday: "I'm sure that there are many people that don't know
that it is illegal to share our source code". He added that the
letters do not amount to threats of legal action at this point.
