The prolific and controversial security researcher who goes by Nightmare-Eclipse released a ninth 0-day vulnerability that allows an attacker to gain SYSTEM level privileges.
On the same day as a major solar eclipse.
What a nightmare this news is.
Is there info on what happened between them?
Their first blog post is this:
I never wanted to reopen a blog and a new github account to drop code…
But someone violated our agreement and left me homeless with nothing. They knew this will happen and they still stabbed me in the back anyways, this is their decision not mine.
And then in a later post:
Normally, I would go through the process of begging them to fix a bug but to summarize, I was told personally by them that they will ruin my life and they did and I’m not sure if I was the only who had this horride experience or few people did but I think most would just eat it and cut their losses but for me, they took away everything. They mopped the floor with me and pulled every childish game they could. It was soo bad at some point I was wondering if I was dealing with a massive corporation or someone who is just having fun seeing me suffer but it seems to be a collective decision.
And one other thing, they do everything but support the research community, I won’t disclose details but they sabotage people a lot. I mean just look at the past, Microsoft is the only major company who had a track of multiple vulnerabilities being publicly disclosed just because the researchers were soo upset by how MSRC treated them.
So it seems like they were mistreated by MS pretty badly here, I’ve heard plenty of horror stories about security researchers being mistreated by big corporations so no surprises there. This one probably takes the cake though if it’s true.
Maaan, the relationship between security researchers for closed software and the companies behind it really needs to improve. AMD recently pulled a related stunt, about which Gamers Nexus made a video.
As much as I despise Windows and Microsoft, I feel bad for those potentially affected.
On the other hand, vulnerabilities like these at least shut up defenders of closed software, given the many vulnerabilities that are being discovered for Linux by AI lately. Better have them easily findable rather than security through obscurity failing and no one notices it being exploited.
Anyway, don’t disgruntle the security researchers testing your product. You end up with an exploit for sale on the dark net, if you aren’t lucky enough for it only being recklessly disclosed to the public for free.