9 ms·

Seems this traces back almost a week, from Nightmare-Eclipse who is the researcher who found this: Tuesday, 12 May 2026 - "Here are the links, yes, two vulnera

Seems this traces back almost a week, from Nightmare-Eclipse who is the researcher who found this: Tuesday, 12 May 2026 - "Here are the links, yes, two vulnerabilities this time [YellowKey] [GreenPlasma] [...] Next patch tuesday will have a big surprise for you Microsoft" Wednesday, 13 May 2026 - "I can't wait when I will be allowed to disclose the full story, I think people will find my crashout very reasonable and it definitely won't be a good look for Microsoft." Author's blog: https://deadeclipse666.blogspot.com/ https://deadeclipse666.blogspot.com/ First post in March 2026 is "[...] someone violated our agreement and left me homeless with nothing. They knew this will happen and they still stabbed me in the back anyways, this is their decision not mine." I'm not sure what to make of it, is this someone essentially "leaking" things from the inside? Sure sounds like it, and others are able to reproduce the results.

krisbolton 6mo ago
I read it as the author is / was going through the vulnerability disclosure process with Microsoft and they're annoyed for unclear reasons and decided to publicly disclose, rather than being an insider.
- mr_mitm 6mo ago
  How would that leave them homeless?
  - allset_ 6mo ago
    Presumably, not paying out for these bugs which often take weeks of research to find.
    - mr_mitm 6mo ago
      Who in their right mind bets on bug bounties to cover their basic needs? They should be highly employable with these kind of skills.
      - cowpig 6mo ago
        people with values different from yours, presumably
        dpark 6mo ago
        This is one it those answers that seems on the surface like it contains insight but on closer inspection it’s vacuous. This could be rewritten as “because they aren’t you”, which is true but not a meaningful or educational answer.
        panflute 6mo ago
        Sure sounds like rhetorical questions or attacking the messenger. Someone can think the bounty industry is going to reward them for actually being exceptional and not look soon enough for other options then pivot to a stance that should give them some quick job offers. If I thought I found an intentional back door I would not engage with an embargo system from the same vendor but I am also not them.
        dpark 6mo ago
        > Someone can think the bounty industry is going to reward them for actually being exceptional and not look soon enough for other options then pivot to a stance that should give them some quick job offers Sure. And that’s a meaningful answer to the question. “people with values different from yours, presumably” is a condescending nonanswer.
        breppp 6mo ago
        This entire thread is generally weird. If someone has this kind of exploit and can't get a bug bounty for it, and desperately needs the money, he can sell it for 100k+ in a shady black market
        LastTrain 6mo ago
        It was about as meaningful as the question it was answering.
  - deleted 6mo ago
    [deleted]
  - 866-RON-0-FEZ 6mo ago
    Many brilliant people have serious mental health issues that preclude their ability to regulate their emotions and act maturely in serious situations e.g. responsible vulnerability disclosure. I've watched genius-level IQ people get fired time and again because they don't know how to work with others at a basic kindergarten level.
    - gusfoo 6mo ago
      There is, sadly, no place for non-standard ICs in corpos nowadays. HR will enforce that.
      - david-gpu 6mo ago
        Emotionally immature people tend to be a liability, not an asset. Therapy can help, but they first need a willingness to do better.
      - wolvoleo 6mo ago
        Yeah I'm getting a lot of pressure to be a "team player" lately. I've told them over and over I'm not capable of that and that has never been a problem before. But we have a hipster new VP who is really pushy and wants to generalise everything.
        stackghost 6mo ago
        If you worked for me and you said you're not capable of being part of a team I'd immediately start looking to replace you. You might be a 100x rockstar developer. You might even be the best software engineer in the world. But the vast majority of good software is built by teams of people. It doesn't matter how good you are if you can't play nice with others. I'd rather have a team of "merely" good engineers than one "rockstar" creating a toxic work culture. Fuck that noise.
        bayindirh 6mo ago
        "Not being a team player" doesn't mean the person is a nuisance, but they can be an introvert who has a limited interaction budget and can work silently and efficiently otherwise. This generally means the person might not leave their cubicle much or give feedback frequent enough, but this doesn't mean they are not motivated to help others or share knowledge. One can approach and ask a question and get tons of help immediately. How I know? That's me. I look like a cave dweller from a distance, but I'm not. The only difference I have is human interaction sometimes drains me a lot, so I just concentrate and work, yet everybody get their help immediately if they need them. Also, no, I don't bite or belittle people. On the contrary. Assuming the worst in others is bad. If I worked with you, I'd be looking for somewhere else the moment I found out how you think about me. Remember. People don't leave bad jobs, but bad managers.
  - zingababba 6mo ago
    https://github.com/BigPolarBear1/The_story https://github.com/BigPolarBear1/The_story I've been pretty convinced this is SandboxEscaper for awhile now.
Alifatisk 6mo ago
Can’t wait to read the blogpost of what have truly happened and motivated this person to expose M$ like this
- SV_BubbleTime 6mo ago
  [flagged]
  - pluc 6mo ago
    Yeah man we've been saying negative things about them for like 40 years must we constantly dwell on what they do wrong? It's time we find positive angles
    - stackghost 6mo ago
      >Yeah man we've been saying negative things about them for like 40 years Well gee, I wonder why people have been saying negative things about them for so long? Perhaps if it's been that long there's a kernel of truth to the matter. Perhaps they're a shitty company who does shitty things selling shitty products.
    - treyd 6mo ago
      They keep doing negative things that influence the industry and infringe upon the freedoms of hundreds of millions of people. Yes we should keep dwelling on that.
      - dijit 6mo ago
        I read the parent as sarcastic. Since the mentioned the continued negative things they do.
    - Cthulhu_ 6mo ago
      Positive HN-appropriate angle: they're very financially successful and have been for 40 years.
  - enopod_ 6mo ago
deleted 6mo ago
[deleted]
bri3d 6mo ago
Previously discussed numerous times on HN, like: https://news.ycombinator.com/item?id=48130519 https://news.ycombinator.com/item?id=48130519 Whether this is a backdoor or not boils down to whatever your usual proclivities about "bug or backdoor" are; it's not like "if microsoft = 1 hack bitlocker" like the tech press seem to love to report. This is a bug in the NTFS transaction log replay functionality in the Windows Recovery Environment WinRE, where it will read NTFS transaction logs from an external volume and apply them to the mounted filesystem. This allows the attacker to perform an authentication bypass against WinRE. With BitLocker without PIN or Password, _any_ authentication bypass becomes a disk encryption bypass, since the disk is unsealed by the bootloader (this architectural "flaw" is true for Linux with the same configuration, as well, like Ubuntu installed with their newish Hardware Disk Encryption checkbox in the installer). In lieu of additional evidence, whether you think the NTFS transaction log issue is a planted backdoor or a simple enumeration bug depends on your conspiracy theory level, like most things in exploit development. To me, it seems like a plausible bug. The weaknesses in boot-time unseal are well known and obvious and this is just one of many, so I don't see it as an earth-shattering revelation, although it is a fun bug.
- bastawhiz 6mo ago
  It's very strange that the same component exists in Windows without the issue, though. Like the author, I'm finding it difficult to come up with reasons why they'd be different.
  - bri3d 6mo ago
    WinRE ending up with a different version of fstx.dll in it seems like a pretty standard Microsoft (or any other big company) thing to have happen? Again, it all comes down to whether you think the drift was a malicious internal fork or a simple mistake. I will say that the functionality being different makes it an inferior backdoor in many ways; especially in Windows land vulnerability researchers are obsessed with binary diffing, and any delta internally would be more likely to be discovered as a backdoor in review too (ie - “hey maybe we should update fstx in winrt finally, let’s review the drift to make sure there’s not going to be a regression, wait a second why did xyz employee add this suspicious looking code”). A fun next step would be to look at different fstx versions to see if it’s just something that was patched or refactored out at some point. At that point it could be a patch-door (ie an organic bug where the patch was held back by interference), but again, that would be a crappy setup due to the propensity for Windows vulnerability engineers to use binary diffing - if you had the exploit and the power to hold back the patch, it would be way better to hold it back everywhere.

krisbolton 6mo ago

I read it as the author is / was going through the vulnerability disclosure process with Microsoft and they're annoyed for unclear reasons and decided to publicly disclose, rather than being an insider.

mr_mitm 6mo ago
How would that leave them homeless?
- allset_ 6mo ago
  Presumably, not paying out for these bugs which often take weeks of research to find.
  - mr_mitm 6mo ago
    Who in their right mind bets on bug bounties to cover their basic needs? They should be highly employable with these kind of skills.
    - cowpig 6mo ago
      people with values different from yours, presumably
      - dpark 6mo ago
        This is one it those answers that seems on the surface like it contains insight but on closer inspection it’s vacuous. This could be rewritten as “because they aren’t you”, which is true but not a meaningful or educational answer.
        panflute 6mo ago
        Sure sounds like rhetorical questions or attacking the messenger. Someone can think the bounty industry is going to reward them for actually being exceptional and not look soon enough for other options then pivot to a stance that should give them some quick job offers. If I thought I found an intentional back door I would not engage with an embargo system from the same vendor but I am also not them.
        dpark 6mo ago
        > Someone can think the bounty industry is going to reward them for actually being exceptional and not look soon enough for other options then pivot to a stance that should give them some quick job offers Sure. And that’s a meaningful answer to the question. “people with values different from yours, presumably” is a condescending nonanswer.
        breppp 6mo ago
        This entire thread is generally weird. If someone has this kind of exploit and can't get a bug bounty for it, and desperately needs the money, he can sell it for 100k+ in a shady black market
        LastTrain 6mo ago
        It was about as meaningful as the question it was answering.
- deleted 6mo ago
  [deleted]
- 866-RON-0-FEZ 6mo ago
  Many brilliant people have serious mental health issues that preclude their ability to regulate their emotions and act maturely in serious situations e.g. responsible vulnerability disclosure. I've watched genius-level IQ people get fired time and again because they don't know how to work with others at a basic kindergarten level.
  - gusfoo 6mo ago
    There is, sadly, no place for non-standard ICs in corpos nowadays. HR will enforce that.
    - david-gpu 6mo ago
      Emotionally immature people tend to be a liability, not an asset. Therapy can help, but they first need a willingness to do better.
    - wolvoleo 6mo ago
      Yeah I'm getting a lot of pressure to be a "team player" lately. I've told them over and over I'm not capable of that and that has never been a problem before. But we have a hipster new VP who is really pushy and wants to generalise everything.
      - stackghost 6mo ago
        If you worked for me and you said you're not capable of being part of a team I'd immediately start looking to replace you. You might be a 100x rockstar developer. You might even be the best software engineer in the world. But the vast majority of good software is built by teams of people. It doesn't matter how good you are if you can't play nice with others. I'd rather have a team of "merely" good engineers than one "rockstar" creating a toxic work culture. Fuck that noise.
        bayindirh 6mo ago
        "Not being a team player" doesn't mean the person is a nuisance, but they can be an introvert who has a limited interaction budget and can work silently and efficiently otherwise. This generally means the person might not leave their cubicle much or give feedback frequent enough, but this doesn't mean they are not motivated to help others or share knowledge. One can approach and ask a question and get tons of help immediately. How I know? That's me. I look like a cave dweller from a distance, but I'm not. The only difference I have is human interaction sometimes drains me a lot, so I just concentrate and work, yet everybody get their help immediately if they need them. Also, no, I don't bite or belittle people. On the contrary. Assuming the worst in others is bad. If I worked with you, I'd be looking for somewhere else the moment I found out how you think about me. Remember. People don't leave bad jobs, but bad managers.
- zingababba 6mo ago
  https://github.com/BigPolarBear1/The_story https://github.com/BigPolarBear1/The_story I've been pretty convinced this is SandboxEscaper for awhile now.

Alifatisk 6mo ago

Can’t wait to read the blogpost of what have truly happened and motivated this person to expose M$ like this

SV_BubbleTime 6mo ago
[flagged]
- pluc 6mo ago
  Yeah man we've been saying negative things about them for like 40 years must we constantly dwell on what they do wrong? It's time we find positive angles
  - stackghost 6mo ago
    >Yeah man we've been saying negative things about them for like 40 years Well gee, I wonder why people have been saying negative things about them for so long? Perhaps if it's been that long there's a kernel of truth to the matter. Perhaps they're a shitty company who does shitty things selling shitty products.
  - treyd 6mo ago
    They keep doing negative things that influence the industry and infringe upon the freedoms of hundreds of millions of people. Yes we should keep dwelling on that.
    - dijit 6mo ago
      I read the parent as sarcastic. Since the mentioned the continued negative things they do.
  - Cthulhu_ 6mo ago
    Positive HN-appropriate angle: they're very financially successful and have been for 40 years.
- enopod_ 6mo ago

deleted 6mo ago

[deleted]

bri3d 6mo ago

Previously discussed numerous times on HN, like: https://news.ycombinator.com/item?id=48130519 https://news.ycombinator.com/item?id=48130519 Whether this is a backdoor or not boils down to whatever your usual proclivities about "bug or backdoor" are; it's not like "if microsoft = 1 hack bitlocker" like the tech press seem to love to report. This is a bug in the NTFS transaction log replay functionality in the Windows Recovery Environment WinRE, where it will read NTFS transaction logs from an external volume and apply them to the mounted filesystem. This allows the attacker to perform an authentication bypass against WinRE. With BitLocker without PIN or Password, _any_ authentication bypass becomes a disk encryption bypass, since the disk is unsealed by the bootloader (this architectural "flaw" is true for Linux with the same configuration, as well, like Ubuntu installed with their newish Hardware Disk Encryption checkbox in the installer). In lieu of additional evidence, whether you think the NTFS transaction log issue is a planted backdoor or a simple enumeration bug depends on your conspiracy theory level, like most things in exploit development. To me, it seems like a plausible bug. The weaknesses in boot-time unseal are well known and obvious and this is just one of many, so I don't see it as an earth-shattering revelation, although it is a fun bug.

bastawhiz 6mo ago
It's very strange that the same component exists in Windows without the issue, though. Like the author, I'm finding it difficult to come up with reasons why they'd be different.
- bri3d 6mo ago
  WinRE ending up with a different version of fstx.dll in it seems like a pretty standard Microsoft (or any other big company) thing to have happen? Again, it all comes down to whether you think the drift was a malicious internal fork or a simple mistake. I will say that the functionality being different makes it an inferior backdoor in many ways; especially in Windows land vulnerability researchers are obsessed with binary diffing, and any delta internally would be more likely to be discovered as a backdoor in review too (ie - “hey maybe we should update fstx in winrt finally, let’s review the drift to make sure there’s not going to be a regression, wait a second why did xyz employee add this suspicious looking code”). A fun next step would be to look at different fstx versions to see if it’s just something that was patched or refactored out at some point. At that point it could be a patch-door (ie an organic bug where the patch was held back by interference), but again, that would be a crappy setup due to the propensity for Windows vulnerability engineers to use binary diffing - if you had the exploit and the power to hold back the patch, it would be way better to hold it back everywhere.