Home / Technology / Microsoft's Legal Threat Sparks Researcher Outrage
Microsoft's Legal Threat Sparks Researcher Outrage
29 May
Summary
- Researcher 'Nightmare Eclipse' disclosed six unpatched Windows zero-day flaws.
- Microsoft threatened legal action against the researcher for uncoordinated disclosures.
- Cybersecurity community criticizes Microsoft's response and past researcher treatment.
A cybersecurity researcher, identified as 'Nightmare Eclipse,' has recently brought significant attention by publicly disclosing six unpatched "zero-day" vulnerabilities in Windows. This researcher has deliberately bypassed Microsoft's established Security Response Center (MSRC) reporting channel, citing alleged mistreatment by the company.
In response to these uncoordinated disclosures, Microsoft issued a blog post reiterating the importance of responsible disclosure and issued a veiled legal threat. The company's Digital Crimes Unit was mentioned as pursuing cases against actors who enable criminal activity, raising concerns within the cybersecurity community.
Many cybersecurity professionals have voiced their disapproval of Microsoft's approach. They argue that the researcher's actions, while unconventional, highlight critical flaws. Several researchers have shared accounts of frustrating interactions with Microsoft's MSRC, detailing instances where vulnerabilities were not promptly addressed or rewards were withheld, further eroding trust.
