Forgot your password?
Close
typodupeerror
Security Privacy Windows

Windows 0-Day Dropped By Disgruntled Researcher Hands Hackers System Rights (arstechnica.com) 42

Posted by BeauHD from the here-we-go-again dept.
An anonymous reader quotes a report from Ars Technica: Nightmare Eclipse, the pseudonym of a researcher with an ongoing, very public beef with Microsoft, has dropped yet another Windows zero-day. On Tuesday, Nightmare Eclipse disclosed SignDrop, a vulnerability that gives local users full System rights on some versions of Windows. The vulnerability resides in the Common Log File System, which Microsoft describes as a "general-purpose logging service used by software clients running in user-mode or kernel-mode." By forcing a privileged process such as Windows Defender to open a crafted CLFS container, an attacker with ordinary user rights can abuse the privileged file creation to elevate privileges to System.

[...] Researcher Will Dormann said in an interview that he has been able to reproduce the exploit and that it works as described, but not on all versions of Windows 11. But there's a catch, he said. "The requirements are important in that it seems to require Windows 26H2, and one that has existed for more than 90 days, it seems," he explained. "That is, you can't just take a new 26H2 system and install updates and have it work." For a system to be vulnerable, Dormann said, the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode value must be 0 or 1." Of the many machines Dormann uses, only a single one met this requirement. Microsoft said in a statement that it was investigating the vulnerability and had no evidence it was being exploited in the wild. The company also said Defender blocks potential exploitation attempts.

Windows 0-Day Dropped By Disgruntled Researcher Hands Hackers System Rights More | Reply

Windows 0-Day Dropped By Disgruntled Researcher Hands Hackers System Rights

Comments Filter:

  • Proprietary code at risk (Score:5, Insightful)

    by hcs_$reboot ( 1536101 ) on Friday November 13, 2026 @10:40PM (#66423725)
    AI is getting much better at reverse-engineering binaries, and find bugs, i.e. exploits. Bad news for proprietary software companies who don't have a whole community to help them. And too bad for Microsoft: plenty of people have been waiting decades for just such an opportunity to get their revenge...

    • Re: (Score:2, Informative)

      by Anonymous Coward
      Microsoft could use AIs to find bugs in their own stuff too y'know.

      They probably are that's why there's been an uptick in the amount of stuff fixed in Windows updates.

      Whether they can fix enough bugs in time for their users...

      • Microsoft could use AIs to find bugs in their own stuff

        Indeed. That's why they didn't have this 0-day we're talking about.

      • Re: (Score:3)

        by Hentes ( 2461350 )

        Right now Microsoft is using AI to introduce bugs into their software.

      • Re: (Score:1)

        by Anonymous Coward

        Still the same as with the eyeballs on open source: Microsoft has one security team using AI to check for security bugs. Linux has everyone who ever wanted to try if their AI can find a security bug feeding the source to AI.

    • All code has always been at risk, it's just a matter of how the bug is found and the speed at which it can be exploited.
      Hopefully within the next year or so code will be much more resilient to these types of early exploits.
      There's always gonna be pain, but it's necessary to move forward. with a more stable and robust system.

    • The problem is that Nightmare Eclipse has a unique style of privilege escalation. While most hackers attempt to find weaknesses in the code, such as buffer overflows, reuse-after-free, and timing attacks, he often finds creative ways to combine the use of normal features of privileged Windows components to create a novel exploit. I don't know if AI is as good at finding these types of exploits because they require a lot more ingenuity. In addition to that, they're harder to develop a long-term fix becaus
  • But now the 0-day is out there, there will probably be evidence RSN (even with the OS requirements). While I would prefer Nightmare Eclipse choose responsible disclosure and let Microsoft fix the bugs before publication, it absolutely is their choice to go another direction (I am, however, surprised they do not simply sell the 0-days on the "market", where they can make substantial money; again, their choice).

  • It wasn't me, it was my AI that went rogue! Opps, my bad. So, we're good now, right?

  • On a quick spot check of a few machines I didnt find any with the required reg key. Not too concerned about this particular one. Not too vulnerable and EDR likely to catch it.

  • All you need... (Score:4, Interesting)

    by joshuark ( 6549270 ) on Friday November 13, 2026 @11:31PM (#66423773)

    All you need to reverse engineer for cybersecurity is NSA's tool "Ghidra Software Reverse Engineering Framework" on GitHub.

    https://github.com/NationalSec... [github.com]

    --JoshK.

  • If you are posting vulnerabilities to hurt anyone. (Score:4, Insightful)

    by Fly Swatter ( 30498 ) on Saturday November 14, 2026 @12:02AM (#66423813) Homepage
    You are no longer a researcher, you are a criminal / hacker / scum.

    Why disgruntled though, not enough bug bounty pay? your name wasn't flashing in the press release? Someone else reported it first?

    • Re:If you are posting vulnerabilities to hurt anyo (Score:4, Informative)

      by kurkosdr ( 2378710 ) on Saturday November 14, 2026 @01:00AM (#66423833)
      Nightmare Eclipse alleges Microsoft unfairly withheld bug bounties and terminated the account used to submit the reports: https://socfortress.medium.com... [medium.com]

      Which if true is very boneheaded of Microsoft, considering there is no legal precedent of security researchers being convicted for not giving OS vendors early disclosure. Microsoft has threatened to sue Nightmare Eclipse for "enabling illegal activity" but hasn't done so.
      • Those unpaid bounties have paled in comparison to the continuing cumulative effect of his findings. Microsoft has tens of billions in cash and still refused to pay this person. It's proving to be one of the most boneheaded moves Microsoft has recently made, and that's really saying something.

      • Nightmare Eclipse alleges Microsoft unfairly withheld bug bounties and terminated the account used to submit the reports

        It's more than that. Nightmare Eclipse is a former Microsoft MRSC employee, Abdelhamid Naceri, who was shitcanned for being a problem. And instead of accepting a settlement offer to just leave, he decided to take the matter to court, where he lost.

        Which is why he has so much information, since he was an insider. And clearly quite talented at identifying security flaws.

        So it's your classic

        • Still, not paying a bug bounty is Microsoft being a jerk. Again, per the legal precedent, security researchers have no obligation to disclose security findings (including vulnerabilities) early to OS vendors, as long as security researchers don't provide binaries and only describe a vulnerability and publish proof-of-concept source code, it's protected free speech.

          Microsoft should have just paid the bug bounties and be glad they weren't sold in the black market, but of course, they had to pinch pennies.

          • The bug bounty story appears to be a smokescreen from before he came forward with his true identity. It is not clear if he was ever submitting the reports through Microsoft's bug reporting system to begin with. Especially as it has been confirmed that his previous claims about Microsoft suing him were fabricated.

            As reported elsewhere, his real beef is with his job. Especially as how he wanted Microsoft to sponsor him so that he could stay in Germany.

            About a week before releasing BigDiskBuster, Nightmare Ecl

    • Full disclosure for commonly used software, irrespective of whether you have a grievance with a vendor or not, is perfectly legal and always has been, even if the result is catastrophic for people who chose to put their systems on the Internet. Heck, you can even release tools which allow for exploitation of a vulnerability if you want in source code form, as that is called free speech and is not the same thing as releasing a compiled binary.

      Folks would have to be seriously brainwashed to think anyone is

      • Folks would have to be seriously brainwashed to think

        They are, they do. It's called "responsible disclosure," but it was named that by gaslighters.

        • Folks would have to be seriously brainwashed to think

          They are, they do. It's called "responsible disclosure," but it was named that by gaslighters.

          I notice you clipped the quote to leave out the word "obligated" in the text you quoted.

    • If Microsoft cared, they would have implemented standard practices to avoid security bugs.

      They didn't, they don't.

    • Re: (Score:3, Insightful)

      by Hentes ( 2461350 )

      Thank you. Hackers may have rebranded to "security researchers", but that doesn't seem to have made most of them any more responsible.

      • There is still a colloquial difference between the use of "hacker" and "security researcher". A "hacker" usually refers to someone who puts the exploit into active use to gain unauthorized privileges on machines they do not own. Hackers generally don't disclose the vulnerabilities to anyone else, especially the publisher, because that would prevent future use of that exploit. A "security researcher" is someone who finds vulnerabilities using equipment that they own and then discloses it. While it's cons

    • > Why disgruntled though

      This person participated in the bug bounty program and Microsoft refused to pay the bounties on reported bugs. Many news stories covered the situation.

      The reported bugs in Defender got CVE's and emergency updates.

      Now she's on a mission.

      A few tens of thousands of dollars was the cost of avoiding all this.

    • Harming Microsoft both causes harm now and reduces later harm done by Microsoft. What's the net?

    • He has been working with Microsoft. There is a history of poor communication, lackluster responses, and a decision not to pay out a bug bounty.

      Microsoft stopped responding to him privately, so he forced their hand publicly.

      Sometimes community members can be ...over enthusiastic... and hard to deal with. They think that whatever they have found should be your top priority, and it just is not. It is a balancing act to keep them on your side. Somebody failed at that with him.

      "What we've got here is... fail

  • Researcher Will Dormann said in an interview that he has been able to reproduce the exploit and that it works as described, but not on all versions of Windows 11. But there's a catch, he said. "The requirements are important in that it seems to require Windows 26H2, and one that has existed for more than 90 days, it seems," he explained. "That is, you can't just take a new 26H2 system and install updates and have it work."

    If it doesn't work on an updated machine, then it's not a 0day.

  • Does this affect my Windows 7? Ha, the devil you know...

Slashdot Top Deals

Last yeer I kudn't spel Engineer. Now I are won.

Close