Microsoft Criticized for Threatening Legal Action Against Security Researcher (yahoo.com)
- Reference: 0183451978
- News link: https://it.slashdot.org/story/26/05/30/0559243/microsoft-criticized-for-threatening-legal-action-against-security-researcher
- Source link: https://tech.yahoo.com/cybersecurity/articles/microsoft-under-fire-threatening-security-170339694.html
Microsoft's response to the researcher? "Threatening to take legal action and call the cops on them."
> On Wednesday, Microsoft [2]published a blog post criticizing the researcher, who goes by the handle "Nightmare Eclipse," for publicly disclosing a series of bugs, including [3]BlueHammer , [4]RedSun , [5]UnDefend , and [6]YellowKey . The flaws affected products such as the Windows built-in antivirus engine Defender and the disk-encryption tool BitLocker.
>
> The core of Microsoft's complaints is that the researcher did not attempt to report the bugs so that the company could fix them. That would have been "responsible," as Microsoft's blog put it. The other side of the company's argument is that by publishing the details of the bugs and how to exploit them before they were patched, Nightmare Eclipse may have aided malicious hackers. Some of the vulnerabilities Nightmare Eclipse disclosed have since been used by hackers in real-world attacks, according to Microsoft, as well as the U.S. cybersecurity agency CISA. "Our [7]Digital Crimes Unit will continue bringing cases against these actors and those that enable their criminal activity — coordinating as needed with law enforcement around the world," Microsoft wrote...
>
> In [8]a series of blog posts published in the last couple of weeks — without providing many specific details — Nightmare Eclipse claimed to have been in contact with Microsoft, but the company allegedly mistreated them, including revoking access to their Microsoft Security Response Center account, the portal where researchers can report vulnerabilities to the tech giant. Nightmare Eclipse's implication was that they had no choice but to release the vulnerabilities publicly... The researchers published the bugs on open source repositories [9]GitHub (owned by Microsoft) and [10]GitLab . The researchers' accounts on those platforms have been banned...
>
> In response to this latest controversy with Nightmare Eclipse, [11]countless researchers have shared their bad experiences reporting bugs to Microsoft.
Thanks to long-time Slashdot reader [12]Elektroschock for sharing the news.
[1] https://tech.yahoo.com/cybersecurity/articles/microsoft-under-fire-threatening-security-170339694.html
[2] https://www.microsoft.com/en-us/msrc/blog/2026/05/a-shared-responsibility-protecting-customers-through-coordinated-vulnerability-disclosure
[3] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825
[4] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091
[5] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498
[6] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45585
[7] http://microsoft.com/en-us/corporate-responsibility/customer-security-trust/digital-crimes-unit
[8] https://deadeclipse666.blogspot.com/
[9] https://web.archive.org/web/20260520184528/https://github.com/Nightmare-Eclipse
[10] https://web.archive.org/web/20260526025939/https://gitlab.com/nightmare-eclipse
[11] https://x.com/vxunderground/status/2060036224245432506/photo/1
[12] https://www.slashdot.org/~Elektroschock
Nonsense (Score:4, Interesting)
Claiming that he had no choice but to release the bugs publicly seems like nonsense to me. His blog posts doesn't really make him appear rational either.
Re: (Score:1)
So your argument is the liability isn't on the company releasing defective software, it's on the people who point out the defects?
There's no public duty to sweep bugs under the rug.
Re: (Score:3)
This. In fact I think it is downright irresponsible. If this guy found the bugs there is a high likelihood others may have as well. Releasing bugs to the public is the better safer approach when finding a zero day, because it gives users a chance to self-mitigate risks before software can be patched. If you tell me there is a risk using my cars garage door opener link without my consent, I can remove that link myself, until the manufacturer releases a patch. Likewise, I can move sensitive information in th
Re:Nonsense (Score:4, Insightful)
Yeah, I think the big question is was Eclipse as unhinged as the blog posts suggests throughout, or was this unhinged state brought on by unreasonable treatment by Microsoft...
From some analysis, I think MS team became less competent and more bureaucratic, and probably struggled to understand whatever the hell Eclipse was getting at, and Eclipse was perhaps on top of confusing was also potentially offended that they failed to respond in what he thought was an appropriate amount of time.
So Eclipse obviously had real stuff, but maybe MSRC couldn't understand, and Eclipse took it gravely personally and here we are.
The other option is that MSRC engaged as described and drove Eclipse to be unhinged after trying to engage in a reasonable way.
My life experience is probably that the former is the scenario, that he was smart, but communicated poorly and took offense easily when faced with a boringly incompetent corp team and mistook their nature for malice initially. Things might have gotten heated on Microsoft's side, but I would guess Eclipse went off the rails first, based on his communication style on display in his blog...
Re: Nonsense (Score:2)
"Life experience" doesn't necessarily need to mean "experiencing the exact same situation", you know...
Solution: give them 90 minutes. (Score:2)
Since '90' is some arbitrary number some tech elites pulled out of their arses, this researcher should decide on a 90-minute window for "responsible disclosure" so they’re covered. I mean, Microslop are the ones that released a defective product in the wild, they’re the ones to really blame for it being found/exploited in the first place.
Full Disclosure needs to come back (Score:4, Insightful)
> The core of Microsoft's complaints is that the researcher did not attempt to report the bugs so that the company could fix them.
The exact scenario we warned about when the discussions about this "responsible disclosure" nonsense started. Someone needs a reminder that letting you know your software sucks is a courtesy, not something you can demand.
Re: (Score:2)
> Someone needs a reminder that letting you know your software sucks is a courtesy, not something you can demand.
In Microsoft's case, I always assume it sucks and let them know about the rare occasions it doesn't. :-)
NSA involvement (Score:4, Interesting)
If Nightmare Eclipse did disclose these vulnerabilites to MS already (and if MS refused to act on them), one has to wonder if at least one of them was a deliberate backdoor left in their software (notably Bitlocker) for the benefit of the NSA? It's already well-known that the NSA has had backdoors for Bitlocker since its inception years ago.
Definitely a bad look... (Score:3)
The whole 'responsible disclosure' preaching and the not-terribly-subtle threats seem particularly bad given that there's an entire industry of actively more dangerous people who are not only treated as legal but actively courted by state agents and cops(and often even less savory customers, though they tend to be cagey about those); the ones who actively seek to keep vulnerabilities quiet so that they can continue to sell exploit tools and services based on them. Throwing zero days on github isn't ideal vs. getting them fixed; but it gets them fixed faster than if Cellebrite wants to hang on to a bitlocker bypass or Trenchant, and L3Harris Technologies Company, wants to keep selling 'network investigative techniques' that can bypass default windows defender configurations or whatever the situation is.
From the outside it's hard to know whether MS actually mistreated the researcher badly enough to justify their displeasure(the consensus appears to be that MSRC was never the best to deal with and has actively gone downhill; but this person's position seems significantly angrier than average) or whether they are perhaps wound a little tight; but implying that their legal status is the same as people actively running attacks against user systems is blatantly false and totally ignores the class of researchers who do actively run attacks while being treated as respectable.
It's a particularly bad look when at least Facebook got into a public legal fight with the NSO group over their nerd-merc work against their users; not like that actually solved the problem of attacks on cellphones; but it was an all-too-rare case of industry pushing back against the 'respectable' arms dealers; and not one that MS has an analog to.
Why is it always on the companies terms (Score:2)
The company assumes no responsibility when selling software but the user needs to assume responsibly when they find something wrong with the software.
Sorry but the company needs to take better care of it's customers if it wants it's customers to care about the company.
First Amendment (Score:3)
In the US this is protected speech. There is a flaw in published software such that x and y... This is a statement of observed fact no matter how obscure.
Poor form, yes. Illegal, no. To threaten or intimidate rather than fix the fault is reliance on the ancient Microsoft trope security through obscurity. Tolerance of that oppressive behavior makes us less secure, not more.
Closing their account on your service is fair game though. No obligation to host anyone for any reason.
Dealing with aggrieved customers is just a part of doing business with the public. No matter how well you behave some people just have issues, and some will have legitimate complaints. Microsoft is a multitrillion dollar multinational corporation. That comes with the turf.
Typical behavior from Microsoft (Score:2)
This has been typical behavior for large companies when dealing with vulnerability reports for decades. Report one, they treat you as the problem. They'll try to ignore it, consider it "not exploitable", delay and deflect as long as they can get away with it, anything but address the vulnerability. And they'll never tell anyone the vulnerability exists. This only changes when they have no choice but to admit to the problem and fix it, usually when the vulnerability is being publicly exploited. They push "r
MS: now known as MicroSLAPP (Score:2)
> [MS' response:] "Threatening to take legal action and call the cops on them."
So I guess we can now call them MicroSLAPP.
"Our teams have been instructed NOT to rappel and (Score:2)
When knocking on your door will suffice.