VMware has confirmed that source code posted on PasteBin by a hacker calling himself “Hardcore Charlie”, is a portion of code from its ESX Hypervisor product.
An advisory posted on VMware’s website, explains that its security team had become aware that a single file from the VMware ESX source code had been posted publicly.
VMware’s statement acknowledged that more files may be posted in the future, but attempted to reassure customers by explaining that the published code dated from 2003/2004.
According to Iain Mulholland, director of VMware’s Security Response Center, “the fact that the source code may have been publicly shared does not necessarily mean that there is any increased risk to VMware customers.”
There is some mystery, however, as to exactly whose security was breached for the source code to fall into the hands of hackers. According to VMware, the firm actively “shares its source code and interfaces with other industry participants to enable the broad virtualization ecosystem today.”
The speculation is, however, that the leak occurred following an alleged network breach at Beijing-based military contractor, the China National Electronics Import-Export Corporation (CEIEC).
For its part, CEIEC denied earlier this month that it had been hacked.
Meanwhile, Hardcore Charlie claims to have gained access to source code from other technology companies. Only time will tell if he goes ahead with his plan to publish it.
