VMware Source Code Leaked, Posted Online
According to a recent disclosure by security firm Kaspersky Lab, a hacker named ‘Hardcore Charlie’ – with assistance from fellow hacker @YamaTough - gained access to approximately 300MB of VMware source code this week, and posted it online.
Revealing that the breach chiefly covered VMware's ESX virtualization product, Kaspersky said that the leaked documents of virtualization software maker VMware apparently comprised “internal VMware communications,” which were pasted onto the letterhead of the China Electronics Import & Export Corporation (CEIEC), and bore some “official looking stamps.”
Acknowledging the breach, but also downplaying its impact, VMware Security Response Center’s director Iain Mulholland said in a Monday statement that the documents in question date back to 2003 and 2004; and probably include the messages which the company has manually added to its source code repository in order to provide content for developers.
Even though Mulholland did not rule out the likelihood of more files being posted in the future, he did mention that the hacked source code has possibly come from a third party; and added that the public posting of the code by the hackers did not necessarily underscore any security issue.
Noting that VMware “proactively shares its source code and interfaces with other industry participants to enable the broad virtualization ecosystem today,” Mulholland said that customer security is a serious issue for VMware and added that the company has “engaged internal and external resources, including our VMware Security Response Center, to thoroughly investigate” the matter.