Microsoft Warns of Legal Action Over Exploit Disclosure

Microsoft is under fire for its approach to zero-day exploits. A user known as Nightmare Eclipse has been in a public spat with the company, sharing proof-of-concept exploit code. Some of their comments hint at a background as a disgruntled former employee. However, what has drawn the attention of cybersecurity researcher Kevin Beaumont is Microsoft’s reaction.

The company has indicated plans to pursue legal action against Nightmare Eclipse for not adhering to “proper coordination” when disclosing vulnerabilities. Additionally, they have disabled Nightmare Eclipse’s accounts on GitHub, GitLab, and the Microsoft Security Response Center. Beaumont highlights the irony: “It’s quite difficult to ‘responsibly’ report future vulnerabilities when you have been banned.”

Beaumont is particularly concerned that Microsoft has employed individuals who have engaged in similar activities. They have hired people who have publicly shared zero-day exploits, some of whom have criminal hacking histories. Moreover, Microsoft has been known to purchase exploits from brokers.

Beaumont encapsulates the situation:
> If Microsoft’s tactic is to try to criminalize not following often arbitrary “responsible disclosure” frameworks, good luck defending that in court — because there’s a whole clown car of prior decision making within Microsoft and facts which would emerge in that process.