lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 13 Feb 2004 09:15:32 -0500
From: jim_walsh@...dyear.com
To: ge@...tistical.reprehensible.net
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com,
   Thor Larholm <thor@...x.com>
Subject: Re: W2K source "leaked"?


There are four different versions that appear to be floating around the 
internet, under 1GB in size, so its definately a 'partial leak' as full 
code is reported as being near 40-50GB in size uncompressed.

As for your press release, M$ has acknowledged it...
http://www.microsoft.com/presspass/press/2004/Feb04/02-12windowssource.asp
Jim Walsh
Operating Systems Administrator
Server Operations and Support Center
Goodyear Tire and Rubber




Gadi Evron <ge@...tistical.reprehensible.net> 
02/12/2004 04:48 PM

To
bugtraq@...urityfocus.com
cc
full-disclosure@...ts.netsys.com, Thor Larholm <thor@...x.com>
Subject
W2K source "leaked"?






A couple of days ago a friend of mine drew my attention to the source 
making rounds on the encrypted p2p networks, I was hoping it would take 
a bit longer for it to be "out", but that was just day-dreaming.

Thor Larholm just gave me this URL, as you can notice, the server is busy:
http://www.neowin.net/comments.php?id=17509

I never believed in 0-days. "New" or more to the point 
un-known-to-the-public exploits and vulnerabilities exist and are being 
used.
In my opinion "0-days" virtually don't exist. It's usually either some 
vulnerability that is long known and a COP or a worm is created. Or 
exploits that will nearly never see the "public" but exist and are used 
by few individuals.. but now... I don't know.

How often does a brand new exploit come out without prior warning and
"attack" the net?

*If* this really is the.. _real_ source code for W2K (and according to 
the article NT4 as well).... we'll see what happens next.

People didn't need help finding vulnerabilities in Windows before, but 
it just became a whole lot easier and a lot less demanding on the "m4d 
#4x0r 5k111z".

I can't really say that the article is right and the source was "leaked" 
or "stolen". The source is being sold/given (?) for years now to EDU's 
and commercial companies for research purposes (not to mention China..). 
I suppose foul play is always possible.

Can anyone confirm this is the real source code? How about a press 
release? :)

                 Gadi Evron



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Powered by blists - more mailing lists