Microsoft backs down after zero-day dispute, says it won’t sue security researchers
Microsoft seeks to reduce tensions with the cybersecurity community and says it has no intention of suing security researchers. The move comes after the company received pushback over its response to public disclosure of a few Windows zero-day vulnerabilities.
Image by Cybernews.
Microsoft seeks to reduce tensions with the cybersecurity community and says it has no intention of suing security researchers. The move comes after the company received pushback over its response to public disclosure of a few Windows zero-day vulnerabilities.
- Microsoft says it will not take legal action against security researchers after Windows zero-day backlash.
- The move follows criticism over its response to a researcher who publicly disclosed multiple vulnerabilities, including BitLocker flaws.
- Tensions flared after Microsoft accused the researcher of violating its Coordinated Vulnerability Disclosure policy.
- The company now says it values the security community and is committed to working with researchers in good faith.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
In recent days, considerable uproar arose following a blog post by Microsoft, in which the tech company lashed out at a security researcher who had revealed various zero-day vulnerabilities in Windows, including a flaw in BitLocker.
However, the details of these vulnerabilities weren’t shared with Microsoft in advance, in accordance with the company’s Coordinated Vulnerability Disclosure (CVD) policy, which riled up the company.
Microsoft condemned the actions of the security researcher, stating that he endangered customers of Microsoft’s digital ecosystem. The company also seemed to hint at prosecuting the researcher.
Since then, a few days have passed, and things seem to have cooled down.
In a message on X, the Redmond-based tech company says that the relationship between vendors and security researchers is critical, but can also be fragile at times.
The Cybernews community is talking about this. Be a part of the conversation.
In addition, which is great news for the security researcher in question, Microsoft no longer seems interested in prosecuting the discoverer of the zero-day vulnerabilities.
“To be clear about our approach to legal matters, we have no intention to pursue action against individuals conducting or publishing their security research. When an individual breaks the law and engages in malicious activity causing real harm to our customers, we will work with law enforcement as appropriate,” Microsoft writes on the social media messaging platform.
The tech company says it recognizes the work that goes into researching and submitting a vulnerability, but also believes in the CVD process.
All in all, Microsoft is grateful to every single member of the security community for their efforts to improve Windows and other Microsoft products and services.
“The security community plays a vital role in helping us protect customers. We are committed to maintaining a constructive and respectful relationship and growing together. We know that, given the nature of this work, there will at times be misunderstandings. We remain committed to engaging in good faith and to providing a respectful and professional experience for all researchers, regardless of past interactions,” the tech company concluded its post on X.
Unlock more exclusive Cybernews content on YouTube.