Microsoft is threatening legal action for disclosing exploits
Microsoft is facing backlash for threatening legal action against a security researcher who disclosed zero-day exploits without following the company's preferred coordination process. The company has also moved to disable the researcher's accounts on platforms like GitHub and the Microsoft Security Response Center.
Why it matters
This case highlights the ongoing tension between corporate security protocols and the independent cybersecurity research community, raising questions about how vulnerabilities should be disclosed.
Microsoft is facing criticism for its handling of zero-day exploits. Someone going by the name Nightmare Eclipse has been publicly feuding with the company, posting proof-of-concept exploit code. Some of their posts suggest that they're a disgruntled former employee. But what caught cyber security researcher Kevin Beaumont's eye was how Microsoft has responded . Microsoft suggests it plans to bring a criminal case against Nightmare Eclipse for failing to follow "proper coordination" in disclosing vulnerabilities. They also disabled Nightmare Eclipse's GitHub, GitLab, and Microsoft Security Response Center accounts disabled . As Beaumont point … Read the full story at The Verge.
The article reports on the conflict by citing both the company's actions and the criticism from independent experts without taking a definitive side.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in