Archive — US — techcrunch
Microsoft under fire for threatening security researcher with criminalinvestigation
Microsoft threatens to pursue legal action against security researcher 'Nightmare Eclipse' for publicly disclosing unpatched bugs in its products, arguing the disclosure aids malicious hackers. This incident revives the debate over the responsibility of researchers in vulnerability reporting and the penalties for non-compliance, amidst broader criticisms of Microsoft's handling of security disclosures.
Key points
- Nightmare Eclipse published unpatched bugs in Microsoft products, including critical security flaws.
- Microsoft criticized the researcher for not reporting the bugs before disclosure, calling it 'irresponsible'.
- The public disclosure has reportedly led to real-world attacks using the disclosed exploits.
- Microsoft's Digital Crimes Unit is involved, threatening legal action against researchers like Nightmare Eclipse.
- The incident highlights ongoing debates about security researcher responsibilities and disclosure processes.
Why it matters
- This incident reflects a continuing evolution in the relationship between cybersecurity researchers and large tech companies.
- The push for compensation and respect for independent researchers has historical roots, notably the 'No More Free Bugs' campaign around 2009.
- As of 2025, the trend of increasing bug bounties and structured vulnerability disclosure processes continues among tech firms.
This controversy underscores the precarious balance between vulnerability disclosure and legal repercussions for researchers, potentially dampening collaboration in improving software security.