Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub bans security researcher who posted zero-day Windows exploits

tomshardware.com

Post reply on HN
Print view View original

71–80 of 274 posts

Re: GitHub bans security researcher who posted zero-day Windows exploits

#71

Post by gchamonlive »

Aurornis wrote: post #62
bitbasher wrote: post #8

I can’t help but feel Microsoft will regret this. Guy finds zero days and gets no compensation. Instead gets banned. Guy sells zero days elsewhere.

But the story is supposedly about him posting the zero-day exploits, not selling them. It’s in the title. He also got banned from Gitlab, which isn’t related to Microsoft at all.

Ever considered these aren't the full set of exploits the researcher discovered? Or that he can find more since he found these? If I found a bunch, I'd certainly withhold a few as insurance.

Re: GitHub bans security researcher who posted zero-day Windows exploits

#72

Post by aussieguy1234 »

SXX wrote: post #11

Also recently: Satya Nadella says as much as 30% of Microslop code is written by AI: https://www.cnbc.com/2025/04/29/satya-nadella-says-as-much-a...

If they're using the "write lots of mediocore code faster" approach to AI and not the "write better code more slowly" approach, this is a security nightmare.

Re: GitHub bans security researcher who posted zero-day Windows exploits

#76

Post by [deleted] »

Aurornis wrote: post #62
bitbasher wrote: post #8

I can’t help but feel Microsoft will regret this. Guy finds zero days and gets no compensation. Instead gets banned. Guy sells zero days elsewhere.

But the story is supposedly about him posting the zero-day exploits, not selling them. It’s in the title. He also got banned from Gitlab, which isn’t related to Microsoft at all.

[deleted]

Re: GitHub bans security researcher who posted zero-day Windows exploits

#77

Post by selcuka »

hedora wrote: post #43
zuzululu wrote: post #21

What's the backstory on this researcher? They seem to have a personal vendetta against Microsoft and thus releasing zero days that he found with the help of AI? Seems like the gold rush period is over for bounty hunters and its more about who has access to hardware/token capital.

It sounds like they're pissed because they produced a large number of high-value exploits, sent them to MS, were treated like crap, and then MS refused to honor their own published bounties: > But to save money, Microsoft fired the skilled people, leaving flowchart followers. I wouldn't be surprised if Microsoft closed the case after the reporter refused to submit a video of the exploit, since that's apparently an MS…

> If this researcher actually had a vendetta, I'd expect them to just sell the remaining zero-days to the highest bidder.

How do we know they didn't? It's called zero-day because Microsoft wasn't aware of the exploits until today. It doesn't mean that no other parties have known about them.

Re: GitHub bans security researcher who posted zero-day Windows exploits

#78

Post by no-name-here »

keepupnow wrote: post #59
akerl_ wrote: post #22

Earlier quoted context omitted.

Do we have any evidence they did that other than the comment you replied to speculating?

Yes they definitely did that. Find evidence to the contrary.

Is this sarcasm? Or are you saying that the onus of providing proof is not on the those making the claim, but instead that the onus of proof is on those who did not make the claim?

Re: GitHub bans security researcher who posted zero-day Windows exploits

#79

Post by jwitthuhn »

Aurornis wrote: post #70
jrflowers wrote: post #2

> forcing them to pack up and move shop to GitLab instead. https://gitlab.com/nightmare-eclipse Blocked user @nightmare-eclipse Looks like they’re banned on GitLab as as well?

Are there any copies of what he supposedly posted? I have a hard time believing someone posted groundbreaking exploits to two separate Git websites and not a single person cloned them. I also think it’s funny that people are alleging .gov conspiracies that end in a publicly hosted “blocked user” page instead of just 404-ing or something.

Forks are still alive on github, so it seems unlikely microsoft did this to suppress the code. Unless they are wildly incompetent, which I don't want to outright reject as a possibility.

https://github.com/xiaoji235/bitlocker-bypass-tool-for-winre

Unfortunately I don't think there is any way to see a list of all the forks now that the main repo is dead, but you can search the phrase "A huge thanks to MORSE, MSTIC and Microsoft GHOST for making this public disclosure possible" to find more copies.

Re: GitHub bans security researcher who posted zero-day Windows exploits

#80

Post by xethos »

thaumasiotes wrote: post #57
hedora wrote: post #43

Earlier quoted context omitted.

It sounds like they're pissed because they produced a large number of high-value exploits, sent them to MS, were treated like crap, and then MS refused to honor their own published bounties: > But to save money, Microsoft fired the skilled people, leaving flowchart followers. I wouldn't be surprised if Microsoft closed the case after the reporter refused to submit a video of the exploit, since that's apparently an MS…

> and the response was flow chart tech support with a "buy a webcam" cherry on top I feel safe in saying that they don't want a video of you at your keyboard typing stuff. An exploit video is a recording of your screen, not of you.

Which, if any of the exploits require anything that isn't on-screen (USB or other HID, key combination), requires a reboot, or anything done before Windows has fully booted, means one must have an external camera

Doesn't sound like it for these exploits specifically (except Yellow Key), but I could be wrong, and again: that's just for these exploits specifically

Post reply on HN