Microsoft under fire for threatening security researcher with criminal investigation | TechCrunch

Microsoft criticized a security researcher for publicly disclosing multiple unpatched vulnerabilities and providing exploit code affecting Windows Defender and BitLocker. Microsoft said the researcher should have reported the bugs to enable fixes before public release, calling that approach responsible. Microsoft also warned that publishing vulnerability details and exploitation methods before patching could help malicious hackers. Microsoft stated that some disclosed vulnerabilities have been used in real-world attacks, citing both Microsoft and CISA. Microsoft said its Digital Crimes Unit will pursue cases against the researcher and others enabling criminal activity, coordinating with law enforcement globally. The researcher claimed prior contact with Microsoft and alleged mistreatment, without many specific details provided.

"Microsoft published a blog post criticizing the researcher, who goes by the handle “Nightmare Eclipse,” for publicly disclosing a series of bugs, including BlueHammer, RedSun UnDefend, and YellowKey. The flaws affected products such as the Windows built-in antivirus engine Defender, and the disk-encryption tool BitLocker."

"The core of Microsoft's complaints is that the researcher did not attempt to report the bugs so that the company could fix them. That would have been “responsible,” as Microsoft's blog put it. The other side of the company's argument is that by publishing the details of the bugs and how to exploit them before they were patched, Nightmare Eclipse may have aided malicious hackers."

"“Our Digital Crimes Unit will continue bringing cases against these actors and those that enable their criminal activity - coordinating as needed with law enforcement around the world,” Microsoft wrote. (Microsoft's Digital Crimes Unit has the mission of protecting the company through different strategies, including “civil legal actions, technical countermeasures, criminal referrals, and public-private partnerships,” according to its website)."

"Some of the vulnerabilities Nightmare Eclipse disclosed have since been used by hackers in real world attacks, according to Microsoft, as well as the U.S. cybersecurity agency CISA. In a series of blogs published in the last couple of weeks - without providing many specific details - Nightmare Eclipse claimed to have been in contact with Microsoft, but the company allegedly mistreated them, includin"

Read at TechCrunch