Microsoft launches damage control after code leaks from Israeli source
The developments in the affair of the leaking of the source code for the Windows operating system continue to make headlines around the world. Tuesday evening, Microsoft officially confirmed that the leak came from a computer at the Israeli Mainsoft software company; but at this stage, the investigation is still underway and no further details are available.
Microsoft is investigating the leak in coordination with the American Federal Bureau of Investigations, and when the probe is complete, Microsoft will publish its findings. Microsoft emphasized that the leak was not the result of a breach of Microsoft's network, nor was it caused by the open code programs under which Microsoft's code is given to big clients such as governments and strategic organizations. The code was given to Mainsoft just as it is given to other Microsoft business partners that are developing software based on Microsoft products.
Just three days after the leak, hackers have already taken advantage of a security flaw discovered in parts of the code that was leaked to the Internet, and have created the first virus based on this flaw. The flaw is in the Explorer browser that is part of Windows.
The storm broke a few days ago, when parts of the source code for Microsoft's Windows 2000 operating system were leaked to the Internet. The source code exposes the innards of the operating system, revealing exactly how it works. Anyone who discovers the source code can do as he pleases with the operating system. Microsoft has been making its living for years from the sale of software licenses; its copyrights to the software are on that valuable source code - the core of the software.
When Microsoft gives the code to business partners like Mainsoft or big clients like governments, the code is marked with a unique "fingerprint" for each client, so that if the code is accidentally leaked, the source of the leak will be discovered immediately.
"Microsoft's greatest fear stemming from the leaking of the code is not a violation of its copyrights," explains Jimmy Schwarzkopf, research director of Meta-Group (Israel). "This is a problem that will eventually be solved in court, because they are protected from a copyright perspective. The problem is the protection against hackers. Microsoft will find it difficult to protect itself. If the code gets into the hands of hackers, their ability to create viruses will be infinite. That is something that will be very hard for Microsoft to combat."
According to the various reports, the Mainsoft computer from which the code was leaked is the computer used by Eyal Alalouf, Mainsoft's director of technology, who has so far maintained media silence and is refusing to respond. Mainsoft is an Israeli start-up that develops software for converting Microsoft applications to run on the Unix operating system.
Mainsoft has already been responsible for one small scandal, when it was reported in 2000 that the company was developing software for converting Microsoft applications to run on the Linux open code operating system - a code that Microsoft refuses to support to this day, and which is considered the natural outgrowth of the Unix closed code. Mainsoft, whose headquarters are in San Jose, New Mexico, and whose R&D center is in Israel, has been a partner of Microsoft's since 1994. Mainsoft has disclosed only that it will cooperate fully with Microsoft and the authorities in investigating the leak. Microsoft and FBI investigators are due to arrive in Israel over the next few days to continue the investigation.
"This story is causing tremendous harm to the Israeli high-tech industry," says Schwarzkopf. "If it turns out that the Israelis are responsible for the leaking of the code, and that it was done maliciously and not by accident, it will burn a great many Israelis in the industry. Israelis have a reputation around the world for cutting corners anyway, and Israelis are working very hard to change this negative image. If the investigations prove that the suspicions were correct, it will not be good for us."