Nightmare-Eclipse Vs Microsoft, Windows Bug BountyVulnerability Researcher finds 6 Vulnerabilities in OS 11, and Now Almost Seven?
Ok, first off, this story alone is nuts. I don’t condone malicious actions, but I did want to cover the story. Second, THANK GOD FOR THE WAYBACK MACHINE! Seriously. This story has been developing for a while now, and I’m probably late to the game; however, it does deserve mentioning.
So what is going on? So far, Nightmare-Eclipse, an anonymous rogue Windows vulnerability researcher or annoyed bug bounty pro that is yet to be paid out, has found 6 vulnerabilities that either A. have never been patched or B. have been found in the wild:
CVE-2020-17103 was apparently not patched or the patch was reversed, regardless this the PoC for an LPE in cldflt.sys …web.archive.org
This repo goes under the CVE-2020–17103:
So for six years, this patch was swept under the rug and, as of this writing, remains unpatched. With the growing need for “AI” embedded in the OS (no one really asked for it), much more is needed than CVEs that were never patched. However, finding this in Hacker News with the MS bug bounty program:
I think this is completely bogus here. However, we’re talking about MS here:
This researcher also found a bypass to BitLocker:
YellowKey Bitlocker Bypass Vulnerability. Contribute to Nightmare-Eclipse/YellowKey development by creating an account…web.archive.org
That, to me, is an insane find and should fall under the scope; however, instead of the payout, they banned this GitHub repo account. Honestly, these zero-day finds/CVEs this account has found blew my mind like also red sun:
MS hasn’t paid or isn't willing to work on the research (honestly, giving them the job at this point would be better), but it's not the first time MS has done something this disruptive, like firing an entire AI ethics team in 2023. So the researcher made their own blog site: https://deadeclipse666.blogspot.com/
With this signature, we know it's the author. In this coming month:
So far, 7 exploits have been found, and it keeps coming:
So this research found a way to break Secure Boot and fully bypass BitLocker…
This is why we should all take vulnerability researchers, penetration testers, red teamers, etc., into more consideration. We can’t live in this reactive state all the time and let bigger companies dictate what is or isn’t a payout. A bug is a bug, or ‘It’S NOt A bUG, iT’s A fEAtURe!!!’. Fix your damn feature then. This next finding basically defeats the purpose of BitLocker (until the patch or release of findings). So July 14 is the release date this year, claims the researcher, and honestly, this will be huge.
Either way, this story is nuts. Seriously, thank you, WayBack Machine, for existing! Thanks for reading, and if Nightmare Eclipse is reading, thank you for reminding me to switch to Mac or Linux as my daily driver. I hope something positive comes out of this. Besides Bit-locker now being useful as a screen door on a submarine. Keep hacking!