Lector saluti,
Microsoft how dare you do this to the security community?It now becomes clear why Microsoft acquired Github.Reason for the removal of exploit code: Working security through obscurity and defending their interests dictatorially,
by deleting all info that they do not like to be made public. In this case that particular POC info,
during times of their Exchange server security drama.
Sign of the times? Is not this against the rules for responsible disclosure to the security community and beyond?
Re:
https://arstechnica.com/gadgets/2021/03/critics-fume-after-github-removes-exploit-code-for-exchange-vulnerabilities/Might not even been Microsoft that removed the Proxy-Logon POC code, but Github itself.
The info iand not gone (e.g. at preatorian dot com with diff between the original and patched code),
and still available on archived repositories, only direct links have been removed.
Again the discussion.
Should we protect users too lazy and irresponsible to patch thousands and thousands of such Exchange servers soon?
Some would certainly speak out for that.
polonus (volunteer 3rd party cold reconnaissance website security analyst and website error-hunter)
