Access to signing keys is very relevant, and I think there is a very real chance (p>0.2) that the huge oversight MS did with the terminal server keys happened because they were ordered to do it.
That's an awfully baroque government backdoor --- a misconfigured X.509 attribute on a certificate that turns out to be signed with a hash for which controlled collisions turn out to be feasible.
The source code to Windows doesn't matter. In 2012, even teenagers find vulnerabilities in Windows by reading the assembly code in IDA Pro. It's one of the most comprehensively reverse-engineered pieces of code on the planet.
mtgx theorized it would be easier with access to the Windows source, and it would, and you know it would, and you're purposely being obtuse; arguing for the sake of arguing.
There is a reason we have programming languages, and we don't all write directly in machine code. Just because it's techincally possible to do things in a more difficult way doesn't mean they would be done that way with a faster, easier option readily available.
Sure, it'd be "easier" in a strictly literal sense. Just as it'd be easier to write these exploits on a system a 60" monitor.
The point is there's not a /significant/ difference; understanding code at a high level doesn't really help to attack it (it can make it harder, since the edges that you look for to exploit are precisely those parts you try and abstract away in a higher-level language), and the windows codebase is well-understood with lots of publicly available information describing in, even without the source code.
How well do you understand the Windows Update MITM issue? Take a stab at explaining exactly what part of it would have been easier with Windows source code?
I don't think so. I won't go on record with what I know but I do know that Microsoft has consented to allow governments audit, review, and sometimes even modify their source code.
I suspect a polite request (perhaps backed by a threat including the L-word) will get them far further than a virus.
Edit: Others have pointed to public documentation of this program. I believe the two cases I was aware of at the time were the governments of China and Germany.
Enterprises w/ 10k+ seats, OEMs, MVPs and governments can get access to Windows source these days. Microsoft launched the program in 2006 or so to dampen the "Linux is more secure because we can see the source!!" FUD.
Government Security Program: Addressing the unique security requirements of governments worldwide by helping government actively participate in ensuring the security of their critical systems. We help enhance system security by providing access to Microsoft Windows and Office source code, prescriptive and authoritative security guidance, technical training, security information, and Microsoft security experts.
The Common Criteria Evaluation and Validation Scheme (CCEVS) is a form of software accreditation that focuses on software security.
You can view the results for the Windows 7 accreditation at [1]. The website also has comprehensive documentation on the methodology used to accredit the software (including visibility of the source code).
