VMware confirms hackers stole source code

VMware has confirmed that source code posted on PasteBin by a hacker calling himself “Hardcore Charlie”, is a portion of code from its ESX Hypervisor product.

An advisory posted on VMware’s website, explains that its security team had become aware that a single file from the VMware ESX source code had been posted publicly.

Image of portion of VMware's source code

VMware’s statement acknowledged that more files may be posted in the future, but attempted to reassure customers by explaining that the published code dated from 2003/2004.

Sign up to our free newsletter.
Security news, advice, and tips.

According to Iain Mulholland, director of VMware’s Security Response Center, “the fact that the source code may have been publicly shared does not necessarily mean that there is any increased risk to VMware customers.”

VMwareThere is some mystery, however, as to exactly whose security was breached for the source code to fall into the hands of hackers. According to VMware, the firm actively “shares its source code and interfaces with other industry participants to enable the broad virtualization ecosystem today.”

The speculation is, however, that the leak occurred following an alleged network breach at Beijing-based military contractor, the China National Electronics Import-Export Corporation (CEIEC).

For its part, CEIEC denied earlier this month that it had been hacked.

Meanwhile, Hardcore Charlie claims to have gained access to source code from other technology companies. Only time will tell if he goes ahead with his plan to publish it.

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.