News

Microsoft has moved to calm an increasingly noisy backlash from the security community after appearing to threaten legal action against a researcher who spent the past several weeks dumping Windows zero-days onto the internet. In a statement published on Monday, Redmond said it has "no intention to pursue action against individuals conducting or publishing security research”, a noticeably softer position than the one it adopted just days earlier when it condemned a string of public vulnerability disclosures and invoked its Digital Crimes Unit. The updated statement follows a public feud with a researcher known as Nightmare-Eclipse, who released multiple Windows zero-days along with proof-of-concept exploit code. Several of those vulnerabilities have since been exploited in the wild, turning what might have remained an obscure disclosure dispute into a much larger argument about how vendors handle security researchers. Last week, Microsoft described the publication of exploit code for unpatched flaws as "never justifiable" and warned it would work with law enforcement when criminal activity harmed customers. The statement triggered immediate criticism from parts of the security community, with researchers warning that the language risked creating a chilling effect around vulnerability research. Former Microsoft employee and security researcher Kevin Beaumont described the company's position as a "dumpster fire of its own making," while Luta Security founder Katie Moussouris, who created Microsoft's bug bounty program, told The Register the response sent mixed messages. She questioned Microsoft's decision to tout researcher compensation and recognition while responding to a researcher who claims he received neither, and argued that references to the Digital Crimes Unit made the post feel "vaguely threatening." She added that, regardless of the specifics of the dispute, Microsoft risked creating a chilling effect on other researchers considering whether to report vulnerabilities. What’s more, if Microsoft's goal was to isolate Nightmare-Eclipse, that may not be going entirely to plan. The researcher claimed over the weekend that other researchers had begun handing over vulnerabilities following Microsoft's response, including an alleged flaw dubbed "Bitskrieg" that breaks Secure Boot trust guarantees and bypasses BitLocker. Nightmare-Ecipse said the bug will be released “sometime in June”. Against that backdrop, Microsoft's Monday message read more like damage control than deterrence. "We have no intention to pursue action against individuals conducting or publishing their security research," Microsoft said, adding that legal referrals would be reserved for people engaging in malicious activity that causes harm to customers. The company also acknowledged that "some interactions have fallen short" and said it was working to learn from feedback. Notably, Microsoft stopped well short of conceding any of Nightmare-Eclipse's specific allegations. The researcher had accused Microsoft of deleting accounts used for vulnerability reporting, refusing to pay bounties, and mishandling communications through the Microsoft Security Response Center. The company has not publicly addressed those claims directly. Nobody should mistake Monday's statement for a sudden conversion to the church of full disclosure. Microsoft remains firmly of the view that researchers should report vulnerabilities privately, give vendors time to fix them, and avoid dropping working exploit code onto the internet for everyone else to play with. The problem for Redmond was that the argument had drifted well beyond the actions of one researcher. What began as a dispute over a string of Windows zero-day releases was rapidly turning into a debate about Microsoft's relationship with the security community and whether the company was comfortable invoking lawyers when that relationship soured. The updated statement looks very much like an attempt to slam the brakes on that narrative. ®

Claude has gone offline on the day after its maker Anthropic filed for what is expected to be a blockbuster IPO. The popular chatbot and coding tool suffered an outage from around 0600 UTC on Tuesday, with Anthropic saying the team was investigating the issue. By 1042 UTC, the status page said a fix had been implemented and the technical team was monitoring the results. Some users continued to complain to The Register about the disruption after that point. Downdetector shows users reporting the LLM service from Anthropic was down twice momentarily yesterday. A surge in reports started from 0700 UTC today and peaked at 0948 UTC, after which they started to fall. The timing of the technical difficulties is unfortunate for Anthropic, the company founded in 2021 by former employees of OpenAI. Yesterday, the company submitted a draft registration statement to the US Securities and Exchange Commission for a proposed initial public offering (IPO) for common stock. It has yet to set the price of shares but a May funding round which raised $65 billion valued the company at around $965 billion (£717 billion), more than rival OpenAI, makers of chatbot ChatGPT. It is set to be a monster year for IPOs, with Elon Musk’s SpaceX and OpenAI also anticipated to join the frenzy. Each is expected to be valued at around $1 trillion. Claude Code has bolstered Anthropic’s reputation and has been well-received by some developers. Reportedly, Anthropic earns more in revenue despite having a fraction of the users OpenAI claims to serve. According to the Wall Street Journal, Anthropic is on the verge of reporting its first quarter of operating profit, according to people at the company who spoke anonymously. ®

The Police Service of Northern Ireland (PSNI) is warning the public to be wary of scammers spoofing its switchboard number in an attempt to profit by calling marks from a "trustworthy" number. A member of the public reported an attempted scam on Monday afternoon. A phone call came in from what appeared to be the PSNI’s switchboard number, and the caller pretended to be a member of the force inquiring about a case in which the recipient was involved. “The caller told the person there was an investigation linked to their name involving money transfers to narcotic-related countries and was subsequently asked to provide information about their bank cards,” said the PSNI’s Inspector Walker. We don’t have any expert criminals here at The Register, but we think it would be pretty sage advice for someone looking to increasingly pass as a police representative not to be so stupid as to ask for gift cards as “part of the investigation process.” “The caller then asked them to purchase gift cards and send across the codes for those, stating that this was part of the investigation process and that the money would be returned to them,” Inspector Walker added. “This made the reporting party suspicious, however, and thankfully, the victim didn’t share any of their personal or bank details with the caller, who they then blocked.” Officials confirmed to The Register that the police’s number was spoofed, and this case was not instigated by a real member of the switchboard team. Spoofing the switchboard’s phone number marked “a very concerning situation,” Walker said, urging the public to remain vigilant to similar calls. The PSNI is continuing to make follow-up enquiries about the report, but has not yet detained any individual in connection with the attempted fraud. Anyone who falls victim to digital fraud in the UK should contact the police, their bank, and Action Fraud, all of which can offer the necessary assistance. “Our advice is that you should never disclose your personal or financial details over the phone, in person, or by email, to someone you don't know,” said Walker. “Guarding your personal and banking details is essential.” The attempted scam is the second disclosed by the PSNI in as many days. On Monday, it warned of a separate case involving an elderly woman being defrauded of a sum north of £250,000 ($336,000) after being targeted by individuals operating a fake cryptocurrency scheme. “After initially sending a relatively small amount, the woman then ‘invested’ larger amounts on a number of occasions after the criminals convinced her that she needed to send more in order to get her initial investment back,” said Detective Inspector Moffett, of the PSNI’s Serious Crime Branch. “After she unknowingly downloaded malware at their instruction, they were able to gain control of her electronic devices and, we believe, transfer further sums from her account.” Cryptocurrency investment scams are among the most pervasive in the world, with figures from the US suggesting the problem is growing increasingly severe. According to the FBI’s annual digital crimes report, it received 48 percent more complaints about crypto investment scams last year than it did the year before, with losses also rising 25 percent. Much of this pain was shouldered by those aged 60 and over, the agency added. ®