Podcast Covers OSV Malware False Positives, Glassworm Takedown and Microsoft Disclosure Dispute
Summary
The episode discusses 157 AWS Inspector submissions to OSV later flagged as false positives, the Glassworm C2 takedown, researchers’ disputes with Microsoft over vulnerability disclosures, and a GitHub threat-hunting guide.
Key points
- AWS Inspector submitted 157 malware entries to OSV that were later withdrawn as false positives; speakers said some entries may have been real malware and validation on both sides was unclear.
- CrowdStrike, Google and Shadowserver took down four Glassworm infrastructure components, including blockchain dead drops, BitTorrent DHT, Google Calendar and VPS servers; the legal and technical basis was unclear.
- The speakers distinguish a botnet, with persistent centrally orchestrated access, from a worm, which self-replicates.
- Nightmare Eclipse’s account of Microsoft’s handling of six unpatched Windows zero-days is disputed; other researchers also described disclosure disputes with MSRC.
- GitHub and GitLab reportedly banned Nightmare Eclipse’s accounts after the disclosures; the speakers said the episode reflects broader concerns about researcher relations.
- A guide co-authored with Feedly describes using GitHub searches for forward-hunting malware and campaigns.
Article Details
- Event Type
- Security news roundup covering the Glassworm C2 infrastructure takedown, false-positive malware reports submitted to OSV, and disputes over Microsoft's coordinated vulnerability disclosure process.
- Impact
- CrowdStrike, Google, and Shadowserver Foundation took down infrastructure associated with Glassworm, including Solana blockchain dead drops, BitTorrent DHT, Google Calendar abuse, and commercial VPS servers. CrowdStrike said infected machines could no longer receive new instructions or payloads; the legal and technical basis for the takedown was unclear. AWS Inspector submissions led to 157 malware entries being treated as false positives and removed from OSV; Paul McCarty said he later found between eight and 15 were real malware. Nightmare Eclipse published six unpatched Windows zero-days after a breakdown in disclosures to MSRC. Microsoft's claim that it had received no prior notice was contested, and other researchers alleged that MSRC mishandled their disclosures. GitHub and GitLab subsequently closed Nightmare Eclipse's accounts.
People
Chi TranAssociated with the AWS Inspector team; cited in connection with AWS's OSV submissions and the admission that new detection rules had produced overly aggressive reports.Gabriel LandauResearcher who said MSRC agreed to issue a CVE for a Device Guard bypass in exchange for an extended disclosure embargo, then patched it silently and did not issue the CVE.Nightmare EclipseResearcher who published six unpatched Windows zero-days after a breakdown in disclosures to MSRC; said MSRC knew BlueHammer was coming. GitHub and GitLab later closed the researcher's accounts.rootsecdevResearcher who said MSRC took five months to respond to a report of a legacy authentication flaw that enabled password spraying while avoiding smart lockout, then said it did not meet the bar for servicing despite silently fixing it.
Malware
Vendors
Amazon Web ServicesOSV false positives from AWS Inspector: AWS’s automated malware detection pipeline submitted 157 false positive entries to osv.dev. The entries were merged before anyone caught the errors. When the community beganCrowdStrikeCrowdStrike, Google, and Shadowserver take down Glassworm C2 (including the botnet vs. worm distinction): The operation targeted four infrastructure components: Solana blockchain dead drops, BitTorrent DHT, GoogleGitHubfollowed by a “doesn’t meet the bar for servicing” response, while Microsoft silently fixed it anyway. GitHub then banned Nightmare Eclipse’s account; GitLab followed suit days later. Paul and Jenn note thisGitLabresponse, while Microsoft silently fixed it anyway. GitHub then banned Nightmare Eclipse’s account; GitLab followed suit days later. Paul and Jenn note this reflects a broader, documented pattern of MSRCGoogleCrowdStrike, Google, and Shadowserver take down Glassworm C2 (including the botnet vs. worm distinction): The operation targeted four infrastructure components: Solana blockchain dead drops, BitTorrent DHT, GoogleMicrosoftYellowKey, GreenPlasma, MiniPlasma) after a breakdown in MSRC’s handling of their disclosures. Microsoft’s claim that no prior notice was given is contested. Nightmare Eclipse says MSRC knew BlueHammer was
Products
AWS InspectorOSV false positives from AWS Inspector: AWS’s automated malware detection pipeline submitted 157 false positive entries to osv.dev. The entries were merged before anyone caught the errors. When the community beganGitHubfollowed by a “doesn’t meet the bar for servicing” response, while Microsoft silently fixed it anyway. GitHub then banned Nightmare Eclipse’s account; GitLab followed suit days later. Paul and Jenn note thisGitLabresponse, while Microsoft silently fixed it anyway. GitHub then banned Nightmare Eclipse’s account; GitLab followed suit days later. Paul and Jenn note this reflects a broader, documented pattern of MSRCGoogle CalendarThe operation targeted four infrastructure components: Solana blockchain dead drops, BitTorrent DHT, Google Calendar abuse, and commercial VPS servers. The legal and technical basis for the takedown is unclear andMicrosoft WindowsEclipse, and the state of coordinated disclosure: Researcher Nightmare Eclipse published six unpatched Windows zero-days (RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, MiniPlasma) after a breakdown in MSRC’sOSVOSV false positives from AWS Inspector: AWS’s automated malware detection pipeline submitted 157 false positive entries to osv.dev. The entries were merged before anyone caught the errors. When the community beganSolanaC2 (including the botnet vs. worm distinction): The operation targeted four infrastructure components: Solana blockchain dead drops, BitTorrent DHT, Google Calendar abuse, and commercial VPS servers. The legal and