EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

12.06.10

Wikileaks/Cablegate Reveals That Microsoft Gave Windows Source Code to TOPSEC, Which Trains and Employs Chinese Cyberspies

Posted in Microsoft, Security, Windows at 11:56 am by Dr. Roy Schestowitz

Kevin Mitnick
Putting Windows source code in the hands
of the Kevin Mitnicks of China

Summary: Microsoft equips private companies — not just governments — with just what they need to intrude all Windows-running computers, namely a key to potential remote access without liability

NOT just incompetence and negligence [1, 2, 3] are the cause of Microsoft’s security problems. Based on Cablegate leaks, it is possible that Microsoft’s secret (and poorly audited) code is exploited so often in China because Microsoft gives them access to this source code (which security researchers in the West cannot see and scrutinise prior to release in binary form).

Several days ago we showed some Egypt cables (prior to Wikileaks being targeted by censors) and it helped show just how closely Microsoft works with governments on ‘security’. The Guardian noticed this independently from us and highlighted the following block (filed under “US embassy cables: China uses access to Microsoft source code to help plot cyber warfare, US fears”):

56. (S//NF) CTAD comment: Additionally, CNITSEC enterprises has recruited Chinese hackers in support of nationally-funded “network attack scientific research projects.” From June 2002 to March 2003, TOPSEC employed a known Chinese hacker, Lin Yong (a.k.a. Lion and owner of the Honker Union of China), as senior security service engineer to manage security service and training. Venus Tech, another CNITSEC enterprise privy to the GSP, is also known to affiliate with XFocus, one of the few Chinese hacker groups known to develop exploits to new vulnerabilities in a short period of time, as evidenced in the 2003 release of Blaster Worm (See CTAD Daily Read File (DRF) April 4, 2008). 57. (S//NF) CTAD comment: While links between top Chinese companies and the PRC are not uncommon, it illustrates the PRC’s use of its “private sector” in support of governmental information warfare objectives, especially in its ability to gather, process, and exploit information. As evidenced with TOPSEC, there is a strong possibility the PRC is harvesting the talents of its private sector in order to bolster offensive and defensive computer network operations capabilities. (Appendix sources 51-52)

So, not just governments are getting access to source code. The “agreement with Microsoft… allowed select companies such as TOPSEC access to MICROSOFT source code in order to secure the Windows platform.” Here it is in raw form. “TOPSEC that trains most of china cyberspys,” Oiaohm quotes from it. “It’s in that cable,” he says. He then gives another direct quote from the cable: “TOPSEC provides services and training for the PLA and has recruited hackers in the past.” On this one he remarks: “Then latter on in the cable to says they have been granted access to MS source code.” The remainder can be read in our latest IRC logs, which make operation of this Web site entirely transparent, unlike governments. “Security by obscurity is that you don’t give the source code to the people attacking your system,” Oiaohm adds and “[i]If you are not using Security by obscurity you might as well publish the source code for everyone to see… At least then you have a better chance that truful ones will tell you where the flaws are.” (typos corrected)

“Proper obscurity can be done with open source”
      –Oiaohm
He continues: “that cable is a security research document in what the hell has gone wrong… That the USA was being breached so much… Also if you dig deeper the USA side is doing the same thing… Both are trying to use closed source to give them a cyberadvantage while both have access to the source code… Proper obscurity can be done with open source… Each system must be able to have many different combinations in its security system to attacker is not quite sure what he will be walking into… So attacks take longer to develop… MS Windows where most installs have basically the same security config… Basically have a obscurity level of nothing.”

Another cable speaks of an “invitation for a private meeting with a named DoS employee. The attached Microsoft Word document was a malicious”. Microsoft is mostly mentioned negatively (for security reasons) in Cablegate, at least thus far. What will be revealed in the remaining 99% of Cablegate (the part which has not been published yet)?

In actual security news (not leaks of old confidential reports), Vista 7 is being bricked by software which claims to improve Windows security:

THOSE WHO ARE RUNNING 64-bit Windows 7 systems should not download the update for AVG Technologies’ AV software.

AVG has withdrawn the update after complaints that the update completely bricked systems by forcing computers to go into an infinite crash loop.

Users of GNU/Linux and BSD never have such problems. Why won’t the US government encourage adoption of Free software, whose transparency makes it secure? It’s the same fallacy about secrecy which toppled both Windows security and now the US government. It arguably censors Wikileaks more zealously than other governments.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. twitter said,

    December 6, 2010 at 4:09 pm

    Gravatar

    Source code disclosure is not a source of insecurity, it is the exclusive disclosure of insecure code to malicious parties that’s the problem. When software is free it can gain a high degree of both transparency and security like OpenBSD and gnu/linux have. When software is not free, the owners lack resources to fix things. Known problems persist for decades and new problems are constantly found when old, non free code bases are forced together in monstrosities like Microsoft Windows. The absolute worst case is when malicious organizations are given exclusive access to source code that other people use. Sadly, this is always the case when people are using non free software but few have betrayed their users the way Microsoft has.

    It has long been known that sharing code with China and other US enemies was a US national security risk. Microsoft representatives testified to this in the Netscape anti-trust trials. Just a few later they started sharing code with the PRC, the former KGB and many other US hostile organizations. It is nice to see that US diplomats were aware of this betrayal but we have to wonder why the US government has not acted on the knowledge. Windows should be dumped and those responsible at Microsoft should be put on trail for espionage.

What Else is New


  1. Links 16/2/2020: MX Linux 19.1 and MyPaint 2.0

    Links for the day



  2. IRC Proceedings: Saturday, February 15, 2020

    IRC logs for Saturday, February 15, 2020



  3. Guest Article: Au Revoir, GNU/Linux

    "Funny how OSI just ended up being another vehicle for their takeover of the computing world..."



  4. Former Microsoft Employee: ZDNet is Owned by Microsoft (and Others) in Some Senses

    A noteworthy message we've received from someone who knows Microsoft from the inside



  5. Links 15/2/2020: Blender 2.82, Qt 5.15 Alpha and NetBSD 9.0 Released

    Links for the day



  6. Microsoft Views 'Open Source' as a Zero-Cost Heist Opportunity (Making Proprietary Software/Spyware Using Other People's Free Labour)

    Making GPL-licensed (copyleft) software and hosting it outside Microsoft’s jaws is the best way to counter the abusive monopolist, which still says it “loves” what it is actually attacking



  7. Did Microsoft 'Buy' ZDNet?

    A look at what ZDNet tells its readers (screenshot from this morning) and a rare look at how its writers are censored/suppressed



  8. Anatomy of a Crime and Protection From Prosecution

    It’s hard to forget what António Campinos hides for his friend



  9. Today's EPO is a Fraud Managed by Frauds

    Beneath the scandals associated with systematic abuse against staff, union-busting (silencing whistleblowers) and en masse granting of invalid patents — the hallmark of grotesque maladministration — lie a bunch of even greater crimes



  10. IRC Proceedings: Friday, February 14, 2020

    IRC logs for Friday, February 14, 2020



  11. One Need Only Look at ZDNet's 'Linux' Section to Understand It's a Microsoft Propaganda Operation

    A timely new snapshot (or screenshot) that demonstrates what ZDNet became after hiring Microsoft employees as ‘journalists’ and censoring on behalf of Microsoft, defaming Free software figures and so on



  12. Links 14/2/2020: New Release of KStars, OpenSSH 8.2, Rhythmbox 3.4.4, Flatpak 1.6.2

    Links for the day



  13. The Uselessness of Social Control Media and Why We Need RSS Feeds' Resurgence More Than Ever

    Social control media became pure noise or misinformation, usually in pursuit of financial expansion alone, and it is also a censorship machine which discourages not falsehoods but unconventional thinking



  14. Another New 'Clown' for the UPC 'Circus'

    A former writer of IPPro Magazine (which seems to be defunct now) reports another shuffle -- perhaps the fifth in a few years -- of "IP" [sic] Minister for the UK; it doesn't bode well for the Unified Patent Court (UPC)



  15. IRC Proceedings: Thursday, February 13, 2020

    IRC logs for Thursday, February 13, 2020



  16. Links 13/2/2020: Ubuntu 18.04.4 LTS, Septor 2020, Endless OS 3.7.7, Wayland 1.18.0, KDE Plasma 5.18 and GTK 3.98 Released

    Links for the day



  17. The Microsoft Propaganda Model

    Classic new examples (real screenshots) of how Microsoft-funded media entraps people looking for information about "Linux" to actually push Microsoft talking points and marketing, cover-up, face-saving lies etc.



  18. What's Evil is Forcing People to Use Something They Don't Want and Typically Dislike

    The difference between Google Search and Microsoft is that many people actually want to use Google (and don't have to)



  19. 2020: The Year Microsoft Became Honest... About Being Corrupt and Criminal

    Microsoft is destroying any past attempts to portray itself as a reformed company or 'recovering criminal'; nothing is really changing and everyone has noticed



  20. Free Software is Being Abandoned by Opponents of Software Patents and It's Being Attacked by Patent Trolls

    The Electronic Frontier Foundation (EFF) is rotting away as an advocate against software patents; Patents on algorithms are still being granted (even when courts repeatedly reject these) and Red Hat's Chief Patent Counsel remains Manny Schecter, one of the loudest proponents of such patents (citing the likes of Adam Mossoff this week, in effect Koch operatives); this is a very big problem because Free software projects come under a barrage of lawsuits, using patents like those IBM lobbies ferociously to legitimise



  21. IRC Proceedings: Wednesday, February 12, 2020

    IRC logs for Wednesday, February 12, 2020



  22. Links 12/2/2020: KDE Neon 5.18, Tails 4.3 and WordPress 5.4 Beta

    Links for the day



  23. IRC Proceedings: Tuesday, February 11, 2020

    IRC logs for Tuesday, February 11, 2020



  24. Links 11/2/2020: New Firefox and KDE Plasma

    Links for the day



  25. Sometimes ILO-AT is Good for Nothing But Law Firms in or Around Switzerland

    ILO-AT’s latest judgements are out. But ILO — and by extension the UN — are still morally deficient and they give the impression that don’t care about people (or that ILO is in bed with the same businesses WIPO (UN) serves, i.e. no better than WB/IMF).



  26. The European Patent Office Continues to Violate the European Patent Convention (EPC) With Impunity While the European Commission Lets That Happen

    The European Commission (and Union) can be seen as increasingly complicit in the EPO's abuses; this means that the EPO has become a liability or source of accountability for the integrity of Europe as a bloc



  27. IRC Proceedings: Monday, February 10, 2020

    IRC logs for Monday, February 10, 2020



  28. EPO Staff Representatives to Challenge Ridiculous and Unnecessary Austerity Measures

    The EPO's President of Nepotism "is currently finalizing his “package” of financial measures in order to reduce an alleged coverage gap of 5.8 B€ following a heavily biased and flawed Financial Study," according to EPO staff representatives who have already demonstrated it's a fake crisis that distracts from the real crisis and profound corruption



  29. You're Almost Guaranteed to Lose the Argument When You Call People Who Plant Seeds 'Pirates'

    The EPO's patent maximalists are damaging the reputation of the institution and harm its perceived legitimacy (people are getting fed up instead of fed)



  30. Unified Patent Corruption

    The Unified Patent Court (UPC) is more dead than ever before; but UPC hopefuls — people who lied their way into this fraudulent pact (designed to enrich only themselves by violating many constitutions) — try telling us otherwise and they’re weaponising corrupt media


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts