Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

On some companies I've worked for, managers have spent quite a lot of money on it-security consultants. Primarily because they're afraid we're gonna get the source code stolen by a rival company. However, as a programmer, I see it as a minor concern that a rival company would find the actual source code useful. After all, just having access to our application is enough, and that can be done without breaking the law. In my opinion, the data handled by the business people would much more useful than source code.

My question is; are there any known examples where source code has gotten stolen AND a rival company have used it extensively?

I know some game engine (quake 1 and half life 2 if I remember correctly) source code has gotten stolen, but I can't really see that really hurt their business.

(I know, this question might be more appropriate for other forum at stackexchange)

share|improve this question

migrated from stackoverflow.com Apr 28 '11 at 7:20

This question came from our site for professional and enthusiast programmers.

5  
If a source code if some security product is stolen, this may allow hackers to more easily analyze it for weaknesses and use them to attack customers using the security product. While the same can be done via means of reverse engineering, it takes much more time to do so as opposed to just reviewing the source code. –  Kostya Apr 27 '11 at 8:10
    
@Viktor, consider moving this to IT Security. –  AviD Apr 27 '11 at 9:34
46  
We used to joke amongst colleagues that anyone who stole our code and could get it working deserved it! –  Benjol Apr 28 '11 at 10:06
    
Some applications have more to lose from source code leaks than others. For example: you can bet that if the source code for XRumer were leaked, then every forum software package would be immune to it the next day. That would put at dent in its maintainer's revenue until they release the next version. –  user16764 Apr 28 '11 at 15:59
1  
@IAbstract - Apple got the idea for a windowed GUI from Xerox Park, who also had one of the first (if not the first) computer mice... ( <cultofmac.com/…; ). Now where did Xerox get the idea from? –  Martin S. Stoller Jul 22 '11 at 21:34

11 Answers 11

The Kaspersky leak earlier this year is a good example. Depending on who you read, the version leaked may have been a cycle or two out of date and the perpetrator may have tried to on-sell it to competitors. Regardless of whether it was sold or not, it's eventual disclosure via torrent is obviously pretty nasty stuff and could (did?) have a serious financial impact.

It was Half Life 2 that was leaked just before release in 2004. There's a very good account of what happened here: http://www.eurogamer.net/articles/2011-02-21-the-boy-who-stole-half-life-2-article

share|improve this answer
3  
+1 for the references and links. –  Alain Pannetier Apr 28 '11 at 10:03
2  
Fascinating article about HL2. +1 –  jnevelson Apr 28 '11 at 15:46

I also think that the fear of someone stealing the precious sourcecode of product x is highly overrated. Even if someone has the source code that does in no way automatically leads to the chance for the thief to make use of that code.

Yes, there is a value in a software product that has been written but a much larger value lies within the heads of the people having developed that application. This can be see when a developer (or a team of developers) leave an existing development project and are replaced by new developers (or consultants, or whatever part the people are having within the project). It often takes a lot of time and effort to bring them up to speed on the technology currently used and the architecture under which the product has been developed. I've seen more than one case, where rewriting an application completely from scratch by bringing in a new design from a new set of people was much faster and much more smooth than trying to digg into existing code and try to understand what it really does.

Just stealing enriched uranium won't (luckily) give you everything you need to develop a nuclear waepon. It's not all that different with source code.

So I think there aren't many references where stolen source code has been used to develop a new application based on the work that somebody else has done. What has been done is stealing ideas of products and then start the implementation process. So, the sensetive part is protecting the ideas - not the product that follows these ideas. The product can be copied very easily.

share|improve this answer
2  
Weapons-grade U-235 is pretty much enough to create a nuclear device, given fairly modest resources and engineering talent. Weapons-grade plutonium would make a better analogy. I do assure you that, if full access to source code was everything, I'd be having a lot less trouble with the U3D software. –  David Thornley Apr 28 '11 at 13:44

are there any known examples where source code has gotten stolen AND a rival company have used it extensively?

One that immediately springs to mind is Microsoft stealing Stac Electronics code for DoubleSpace. It ended up in court and the cheapest solution for Microsoft was to purchase Stac (originally they claimed to want to do so, which is why they got access to the source, but then chose to deploy the copied code as Drivespace and then taunted Stac with "what are you going to do about it?").

share|improve this answer
    
and also Microsoft's stealing i4i's xml search/custom fields concept when they collaborated together. –  gbjbaanb Jul 22 '11 at 15:58
    
The main issue I see if a company tries to steal ip is the prior art component. It cannot make a patent application unless it's markedly different from the original –  GrumpyMonkey Jul 22 '11 at 22:15

Here are a few examples I'm personally aware of...

AT&T developed the yacc parser generator, and lex lexical analyzer generator, as part of Unix. You were only supposed to get copies of the source if you'd gotten a Unix source license... but somebody swiped a copy off the desk off the desk of a person who shall remain anonymous here sometime around 1980. (It wasn't me, and I'm not sure he'd want his name bruited about.) The source started floating around, people ported them to the IBM PC, yadda yadda. I got copies from an outfit in Austin that was selling "source code for nifty programs" floppy disks around 1986.

Back around 1990, Microsoft had kind of a reputation for this, although I'm not sure it was exactly corporate policy. In addition to the Stac case Tangurena mentioned, a consulting company that had previously done work for Apple to port QuickTime to Windows re-used some of the proprietary QuickTime sources in a project for Intel and Microsoft to accelerate MS's Video for Windows. Apple wound up getting a stop-ship injunction against Video for Windows. It's certainly not clear to outsiders whether anybody at Intel and/or Microsoft knew about this theft.

This doesn't really happen very much, though, with US companies - the risks are far too high. For instance, I was a contractor at the now-defunct database vendor Informix when they were in the middle of a benchmark battle with Oracle, and Informix kept winning. Oracle hired away one of Informix's core database engineers, and he showed up to the job the first day with a hard drive full of the Informix sources, thinking they'd welcome him with open arms. They welcomed him, all right - with a security team to escort him to the police station. They also called Informix security to come over and retrieve the unexamined hard drive.

share|improve this answer
1  
+1 for the interesting Unix history. –  Niklas rtz Sep 1 '11 at 16:39

I think this heavily depends upon the specific code base. I would be surprised though if more than a tiny minority of proprietary source code is worth stealing.

In most cases source code is a liability, not - as some business people like to think - an asset. The asset is the running executable and the people who know how to adapt and evolve it along future business requirements.

Apart from the high legal risk of stealing source code and the direct cost of procuring it, your own developers need to understand it. Which - especially if the original developers are not around to help - is a huge undertaking for a non trivial code base. Peter Seibel (of Practical Common Lisp and Coders at Work fame) once said the amount of time is in the same order of magnitude as the original development effort.

There are exceptions though, e.g. if the code base...

  • ... contains highly valuable, easily identifiable, discrete parts (e.g. a proprietary algorithm with significantly superior characteristics to commonly known counterparts)
  • ... draws significant value from 'obscurity', such as some security related products
  • ... is in itself very small, with strict correctness requirements, as commonly found in embedded software (i.e. the value being in being extensively tested, reviewed and maybe even been subject to formal proofs)
  • ... contains evidence of neglect/breach of contract/unethical business practices/incompetence etc.
share|improve this answer

A famous case was when the Goldman Sachs high-frequency trading source code was stolen by an ex-employee: http://www.bloomberg.com/apps/news?pid=newsarchive&sid=axYw_ykTBokE

In this domain, source code is valuable, because it contains the trading algorithms.

share|improve this answer

This kind of thing is of some interest to product developers, where the embedded firmare is the GOLD, and there have been cases over the years of source or object code being stolen. You'll find the occasional write up more in the engineering magazines.

share|improve this answer
    
Of course being embedded firmware never stop people from trying to reverse engineer Nintendo's systems from the 1980's. I do believe many people were able to do just that. We have emulators that are running on the iPhone that let you play 20 year old games. –  Ramhound Apr 28 '11 at 12:09
    
An emulator for a game is not quite the same thing as stealing the firmware that runs some of the more ubiquitous products - for example, why pay somebody to develop firmware for a washing machine controller if you can just steal somebody elses. It might not seem like a lot of $, and its not a very good example. There are other examples though where microcontrollers can get the firmware read-out (eg by etching off the epoxy and probing the die), because the contents are worth the trouble of doing all this. –  quickly_now Apr 29 '11 at 0:47

Yes, there are several examples, but none I know of with proprietary code. See http://gpl-violations.org/ for examples of where companies have used open source code as if it was their own. In these cases, getting the source code was not a problem as it was open source.

share|improve this answer
    
It's not true there are no examples with proprietary code. See the other answers. –  Bob Murphy Jul 22 '11 at 15:49
    
@Bob Murphy: My mistake. Added "none I know of" to my answer. –  Martin Vilcans Jul 22 '11 at 18:51
    
<chuckle> Happens to me all the time. –  Bob Murphy Jul 22 '11 at 21:27

It all depends on what type of application it is and how easy the behavior of the application is to replicate. I am certain Microsoft would love to get their hands on the source code for Google's search engine. They would inflict heavy losses on them if they did so.

However, any experienced developer can copy the exact behavior of 99% of web or desktop applications without the source code anyways.

Where it does matter is where a company has put extensive work into either an engine (i.e. a physics engine, search engine) that no-one else has been able to make as well or an O.S.

That said, most of the time, it doesn't really matter.

share|improve this answer

I can think of two examples:

  • Tengen illegally obtained the code for the NES copy protection chip. They then used that code to make unlicensed NES cartridges (including Tetris). How did they obtain the code? By social-engineering it out of the U.S. Copyright Office. In other words, they falsely claimed that they were being sued by Nintendo and that they needed the source code to prepare their defense. It worked.
  • See ARJ vs PK-ZIP.
share|improve this answer

Generally, stealing code isn't worthwhile as if you're a business, and you're found using somebody's code without permission, they can sue the living daylights out of you.

The only problem I really see with having your code stolen is A ) people on the internet, not companies, using it for free and modifying it, and B ) if they were to go far enough to use your source code to then perform clean-room reverse-engineering.

http://en.wikipedia.org/wiki/Clean_room_design

It would be a tremendous effort on their part though, so as long as your licencing terms are fair then I don't see it being feasible.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.