Code leak spurs Windows Server 2003 piracy

A key code for installing Microsoft's Windows Server 2003 has leaked onto the internet, a move that could lead to widespread piracy of the software.

A Microsoft spokeswoman confirmed the leak late on Monday and said Microsoft was investigating the matter. The code key leak comes more than two weeks before the software's scheduled release on 24 April.

The leaked code appears to be from a Microsoft corporate customer subscribing to one of the company's volume-licensing programmes, the spokeswoman said. Rumours circulating on enthusiast websites, such as Neowin and WinBeta, identified the leak as a '3-in-1 code', meaning that it would work with three different versions of Windows Server 2003.

The Microsoft spokeswoman made clear that Microsoft would scour the internet looking for the leaked code. "Our legal department works aggressively on that kind of thing," she said. Stolen codes are often traded with the Microsoft software, typically on websites, newsgroups or Internet Chat Relay (IRC).

The leaked key codes cast an unexpected shadow over the launch of Windows Server 2003 later this month. Microsoft is banking on the thrice-delayed operating system to increase its penetration into the enterprise. But the stolen codes show the difficulty the company faces in protecting its valuable intellectual property and potential sales from thieves.

The use of the code is a two-step process and it is the second one that will cause Microsoft the most problems, analysts say. The code is first used to install the software and the second step uses the code to activate the software with Microsoft via the internet.

With the release of Office XP in May 2001 and Windows XP about six months later, Microsoft added a piracy-fighting tool known as product activation. Before then, businesses or consumers needed a key code to install Microsoft software, and the process stopped there. Product activation went a step further: the computer needed to contact Microsoft over the internet. During this process, hardware configuration and licence information were collected and associated together in an anonymous database.

The process essentially locked the activation code to hardware, in theory preventing the key from being used to install the software onto another computer. Microsoft banked on the process for reducing widespread piracy of its Windows products. For example, the company estimates that about half the copies of Office in use worldwide are pirated.

But Microsoft's piracy fighting tool has a potential flaw. For convenience, subscribers to Microsoft's volume-licensing program are issued keys that do not need activation. This makes it easier for businesses to quickly install the same software on many computers at the same time, without the labourious process of activation for each one. Should a code leak onto the internet, as it did with Windows Server 2003, the single code can be used to install an unlimited number copies of the software.

"That's the problem with this technology, you have to keep those keys safely guarded," said Michael Cherry, an analyst with market researcher Directions on Microsoft. Cherry said that the leak could have happened any number of ways. "It could even have been a disgruntled employee," he speculated.

Microsoft could not confirm which Windows Server 2003 versions the code unlocked, but unconfirmed reports circulating the Web on Monday identified the Standard, Enterprise and Web editions.

There is little Microsoft can do to stop the pirated software from spreading; the best it can do is contain the damage. Two volume-licence code keys also leaked out ahead of the release of Windows XP, but the company was essentially powerless to respond.

With the release of Windows XP Service Pack 1, the first collection of bug and security fixes for the operating system, Microsoft put a lock on software installed with the stolen codes. Service Pack 1 would not install on pirated versions, but Microsoft offered no mechanism for turning off pirated copies. The company estimates that 90 per cent of Windows XP piracy can be traced back to those two codes.

A Microsoft spokeswoman said there is no Windows Server 2003 mechanism for disabling software identified as having been installed using a stolen code. In theory, such a mechanism might be capable of disabling software during a routine update with one of Microsoft's Web servers.

Those copies of the software installed using the leaked code "won't be able to install future updates or service packs of access Windows Update", the spokeswoman said.

"They're caught between a rock and a hard place," Cherry said.

Software piracy is not just a Microsoft problem. The Business Software Alliance (BSA) estimates that 25 per cent of software used in the United States is pirated and that the worldwide figure is 40 per cent. China, Indonesia, Nicaragua, Pakistan, Russia Thailand, Ukraine and Vietnam have piracy rates of 78 per cent or more, according to the organisation.

from http://www.silicon.com/news/500013-500001/1/3658.html

Opps..

Sil

Is that an own goal, again!

more from compwire

The wheels appear to have fallen off of Microsoft Corp's planned launch of Windows Server 2003, due this month, as software used to "unlock" new copies of the operating system has been leaked online.

A Microsoft spokesperson said yesterday that a volume licensing key has been posted to some "specialist" web sites along with illegal copies of Windows Server 2003.

Volume licensing keys are used by enterprise customers to activate new copies of Microsoft's operating system in large-scale deployments. The key allows customers running hundreds of PCs to side step Microsoft's product activation mechanism, introduced with Office XP and Windows XP to clamp down on piracy.

Microsoft's spokesperson said that the danger now was that many more illegal copies of Windows Server 2003 could be activated using the volume licensing key. It is not known how many copies of Windows Server 2003 have so-far been posted online.

News of the leak comes as Microsoft prepares to launch Windows Server 2003 on April 24 in San Francisco, California. The company is expected to use the event to promote both the operating system's scalability and its optimization with Intel Corp's underlying hardware for increased performance speeds.

In a by-the-numbers Windows launch routine, Microsoft is also expected to name a number of headline-grabbing customers as early adopters of the operating system.

perhaps win2k3 will be more popular than m$ first thought due to their new WPA policy

Sil

From Fairfax I.T

The number of sites running Windows Server 2003 is already more than the number running Solaris 9, even though the former has not yet been formally launched, the latest monthly web server survey from Netcraft has found.

The monthly survey looks at web server software usage on internet-connected computers, collecting and collating as many hostnames as can be found providing an HTTP service. Each is systematically polled with an HTTP request for the server name. The April survey received responses from 40,100,739 sites.

The survey said though Solaris 9 had been launched in May 2002, its parent company Sun Microsystems seemed to take a relaxed view about envangelising new operating system versions as even www.sun.com was still running Solaris 8.

Microsoft appears to be at the other end of the spectrum; www.microsoft.com started running Windows 2003 last July.

The survey noted that the share of web servers across the sites surveyed remained about the same with Apache still running about two-thirds of the sites.

'Slo

you know I wonder if these 'leaks' aren't sometimes intentional?

I mean despite everything m$ have done to XP to stop it being copied it is still copied, it seems quite hard (apparently) to make something that is installable w/o too much hassle and at the same time make it impossible for people to copy, m$ must have accepted that some percentage of copying will occur no matter what?

I think there's a possibility that m$ gets a kind of 'pay back' for 'leaking' copies like these, the real market for win2k3 is companies, they are less likely (I would guess!) to use dodgy copies than individuals.

More indivduals using win2k3 (even if they are using non-paid copies) means that the OS gets talked abt more on the 'net and people may try it out based on what others are saying, as one example.

Sil

That's basically my thoughts too. But what I think it really means is that slowly more and more 'users' get 'pulled' into MS's net (excuse the pun!).

yeah but how long will it be until someone writes a key changer for it? XP key changers where out even before SP1 was out and locking out the dead keys.

they will get win2k3 no matter what microsoft do. all microsoft can do is to try and skiw them down.

~Mem

All it takes is one very clever 14 year old, and there you have it

Behemoth