Windows leak site Wzor goes dark a day after feds arrest Microsoft mole

Noted Russian leak website disappears, Twitter account vanishes the day after a Russian national was accused of sharing Microsoft trade secrets

The noted Windows leak site Wzor.net was offline Thursday and its Twitter account had disappeared, a day after an ex-Microsoft employee was charged with stealing trade secrets -- including early builds of Windows 7 and Windows 8 -- and sharing them with others.

It's unknown whether there was a connection between Alex Kibkalo, the former Microsoft architect who was arrested Wednesday, and Wzor.net.

According to checks conducted by Computerworld, Wzor.net was offline and unreachable from the U.S., the U.K. and Romania. Websites that verify whether a specific website is up and running -- including Where's It Up and Is It Down Right Now? -- showed that Wzor.net was offline around the world.

"Wzor.net is down for everyone," the Is It Down Right Now? website reported.

Wzor's Twitter account had also vanished by early Thursday. "Sorry, that page doesn't exist," Twitter reported after attempts to access the account.

Kibkalo, a Russian national who worked in Microsoft's Lebanon office when he allegedly shared pre-release code for Windows RT and the internal-only Activation Server SDK (software development kit) with an unidentified French blogger, was arrested and detained yesterday. Wzor.net was a Russian-language website known for its prodigious publishing of leaked information about Windows pre-release builds.

Last month, Wzor leaked an early version of Windows 8.1 Update, the refresh Microsoft is expected to push to customers on April 8.

In the complaint filed with a Seattle federal court Monday -- but unsealed Wednesday -- authorities said instant message logs showed that Kibkalo claimed to have also leaked early builds of Windows 7 and Windows 7 Service Pack 1 (SP1). Those versions of Windows were publicly released in 2009 and 2011, respectively.

Kibkalo worked at Microsoft for seven years, from May 2005 until September 2012, according to his LinkedIn profile, which remained available Thursday.

Kibkalo was terminated by Microsoft after an internal investigation, prompted by the discovery of emails from him to the blogger, whose Hotmail account contents had been read by officials in Microsoft's Trustworthy Computing Investigations (TWCI), a department tasked to protect the company from outside hackers and internal leakers. Kibkalo allegedly used his own Hotmail account to contact the blogger and his SkyDrive account to share code, including the Activation Server SDK.

According to the FBI, Kibkalo also set up a virtual machine on a Redmond, Wash.-based server owned by Microsoft to expedite his code theft and sharing.

During the years 2005-2010, Kibkalo worked for Microsoft's Russian operation before transferring to Lebanon.

Microsoft did not immediately answer questions about whether the Wzor.net outage was its doing or connected to the Kibkalo case. As for Kibkalo's arrest and alleged theft, a company spokeswoman said, "We take protection of our intellectual property very seriously, including cooperating with law enforcement agencies who are investigating potential criminal actions by our employees or others."

Wzor.net was offline worldwide on Thursday, a day after a Microsoft mole was arrested for stealing and sharing the company's unreleased code. (Image: Is It Down Right Now?)

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed. His email address is gkeizer@computerworld.com.

See more by Gregg Keizer on Computerworld.com.

CAPTION:

Read more about legal in Computerworld's Legal Topic Center.

Tags MicrosoftlegalcomputerworldWindowstwittersoftwareoperating systems

More about AppleFBIGoogleHotmailMicrosoftTopic

Comments

Comments are now closed

Data retention: iiNet raises spectre of ‘surveillance tax’ for ISP customers

READ THIS ARTICLE
DO NOT SHOW THIS BOX AGAIN [ x ]