Microsoft Under Fire for Threatening Security Researcher with Criminal Investigation

In light of a security researcher’s recent publication of unpatched vulnerabilities in Microsoft products, the company is now threatening legal action and law enforcement involvement. This renewed threat from Microsoft sparks a long-running discussion regarding the responsibilities of security researchers when it comes to disclosing vulnerabilities that affect major tech firms.

On Wednesday, Microsoft published a blog post criticizing the researcher known as “Nightmare Eclipse” for publicly revealing multiple vulnerabilities, including BlueHammer, RedSun, UnDefend, and YellowKey. These vulnerabilities impacted various products, such as the Windows Defender antivirus engine and the BitLocker disk-encryption tool.

Central to Microsoft’s argument is the accusation that the researcher did not report these vulnerabilities in advance, which would have allowed the company to implement fixes. They claimed that this approach would have been the “responsible” course of action. Furthermore, Microsoft contends that by prematurely disclosing the vulnerabilities and their exploitation methods, Nightmare Eclipse may have inadvertently aided malicious actors. Reports indicate that some of these vulnerabilities have already been exploited in real-world attacks, as stated by both Microsoft and the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

“Our Digital Crimes Unit will continue to pursue legal action against these individuals and any parties that facilitate criminal activities—coordinating with law enforcement globally as necessary,” Microsoft declared. (According to its website, the Digital Crimes Unit aims to safeguard the company through various strategies, including “civil legal actions, technical countermeasures, criminal referrals, and public-private partnerships.”)

In recent blog entries, Nightmare Eclipse claimed they had attempted to contact Microsoft but were treated poorly, including the revocation of their access to the Microsoft Security Response Center account used for reporting vulnerabilities. They implied that they felt compelled to disclose the vulnerabilities publicly, effectively transforming them into zero-day flaws—those unknown to the affected software maker at the time of disclosure.

The researcher shared the vulnerabilities on open-source platforms GitHub (owned by Microsoft) and GitLab, only to have their accounts banned from both services.

Neither Nightmare Eclipse nor Microsoft provided comments upon request.

Cybersecurity Experts Warn of Chilling Consequences

This public dispute reopens a persistent and often contentious debate: Do independent security researchers have a duty to ensure that any vulnerabilities they discover are addressed? What steps should they take to guarantee that the companies with vulnerable products actually respond to these issues?

One widely accepted point in this discussion is that researchers should be compensated for their efforts. While this may seem obvious today, it took years of advocacy to achieve this understanding, famously highlighted by the 2009 campaign “No More Free Bugs.” Nearly two decades later, most companies, regardless of size, now offer “bug bounty” programs that can reward researchers with significant financial incentives—sometimes reaching six figures—for privately disclosing vulnerabilities and coordinating the release of details after fixes have been made.

In light of the current situation surrounding Nightmare Eclipse, many researchers have shared their negative experiences reporting vulnerabilities to Microsoft. It is evident that a substantial portion of the cybersecurity community is dissatisfied with Microsoft’s handling of this issue. Among them is cybersecurity veteran Katie Moussouris, founder of Luta Security, who, while at Microsoft in the mid- to late 2000s, was pivotal in developing bug bounty programs and advocated for a transition from “responsible disclosure” to “coordinated disclosure.”

“The invocation of ‘responsible’ disclosure was a misstep in my opinion,” Moussouris remarked in an interview with TechCrunch, referring to Microsoft’s blog post. “The added threat of legal action, especially mentioning [Digital Crimes Unit], is excessive and will only harm trust among security researchers toward Microsoft.”

Moussouris warned that a breakdown in trust between security researchers and Microsoft could discourage individuals from reporting bugs, ultimately making the digital environment less secure for everyone.

Security researcher and former Microsoft employee Kevin Beaumont criticized the company as well, describing its stance as a “dumpster fire of its own making” in a blog post.

“Is creating and disseminating proof of concept exploits for zero-days now deemed ‘criminal activity’?” Beaumont asked. “The idea of responsible disclosure often prioritizes the interests of the product owner over those of the customer—using it as a basis for potential criminal prosecution is a new low.”