Sam Pope

Things I break: Software ,Passes, My own body. MSRC UK Software Researcher & Swindon Storm CB #20

[Chumy @rm_rf_chumy]

Love that MSRC pays the same bounty as Pwn2Own. ❤️

[SinSinology @SinSinology]

everyone, i need your help, anyone can hook us up with the "ESXi version 9.1.0.0"?
your RT is really appreciated, this is Urgent AF.

[Microsoft Security Response Center @msftsecresponse]

Thank you to everyone who joined us for the MSRC Researcher Celebration at Black Hat Asia. It was great to connect with so many in the community and spend time sharing ideas and conversations.

We appreciate the collaboration that drives this work forward and look forward to what we’ll build together next.

[Microsoft Security Response Center @msftsecresponse]

Join the Microsoft Security Response Center (MSRC) for our Researcher Celebration at Black Hat Europe on Wednesday, December 10, from 4:30–9:00 PM.

This event honors the contributions of the global security research community. Connect with peers, celebrate achievements, and enjoy networking with researchers from around the world.

Apply to attend now: https://t.co/6adjtXT2JV

#BHEU

[Microsoft Security Response Center @msftsecresponse]

File system redirection has long been a tool for attackers seeking privilege escalation. RedirectionGuard, a new Windows mitigation, is designed to block malicious junction-based redirection by default, strengthening system security.

Key Features of RedirectionGuard:
•Blocks junction traversal only when followed by an opted-in process and when created by a non-admin user.
•Stores privilege metadata in an admin-only alternate data stream to verify junction trustworthiness.
•Already enabled in Windows Insider builds for User Profile Service, AppX Deployment Service, and Installer Service, historically among the most vulnerable components.

Learn more in our new blog by Mike Macelletti (@pintostart), Senior Security Researcher, Microsoft: https://t.co/H8n4XZqKXP

Many thanks to Georgios Baltas (@gebaltas) and James Forshaw (@tiraniddo) for their contributions.

[Rohit Mothe @rohitwas]

Looking to hire 2 experienced Security Researchers in the US for the Exploits Research Team within the Microsoft Security Response Center (MSRC)

Senior Security Researcher
https://t.co/po3EwcKeyt

Security Researcher II
https://t.co/iFpxJ4uBIq

[SinSinology @SinSinology]

Launching a student-only free workshop: ".NET Exploitation Basics" 🪲
If you're a student (or know one), let's write some deserialization exploits, Manchester, July 12.
10 seats.
https://t.co/ZNdfB8R1pO

[Sam Pope @20brokenSP]

8 years ago I attended my first #Pwn2Own in Vancouver whilst I first learnt to write rop chains…now I’m here in Berlin representing @msftsecresponse exploit response! Quite the adventure 😎

[Microsoft Security Response Center @msftsecresponse]

Earlier this month, we hosted the Microsoft Zero Day Quest, the largest live hacking event of its kind. This inaugural event brought together top security researchers from around the world to find the highest-impact vulnerability scenarios in Microsoft Copilot and Cloud.

The result? More than 600 vulnerabilities submitted and $1.6 million awarded, with additional findings still under review.

We're also making two major commitments moving forward:
1. Continuing the 100% AI bounty award multiplier
2. The Microsoft Zero Day Quest will be an annual event

This is just one part of Microsoft’s broader bug bounty program, which awarded over $16 million in 2023. We're proud to work with the global research community to help secure the future—by design, by default, and in operation.

Read more in our blog post by Tom Gallagher (@secbughunter), VP of Engineering, Microsoft Security Response Center: https://t.co/2c7RDySWch

[Microsoft Security Response Center @msftsecresponse]

Day 2 of #ZeroDayQuest brought together brilliant minds from around the world for more hands-on hacking and meaningful community connections. Catch the energy in our recap video!

@secbughunter @tinderj_ @ZenOneSec @0xdea

[Microsoft Security Response Center @msftsecresponse]

Day 1 of the Zero Day Quest Onsite Hacking Event is in the books and we’ve kicked off Day 2.

We welcomed top security researchers from around the world to Microsoft’s Redmond campus for a day of live hacking, collaboration, and connection.

Researchers worked side-by-side with Microsoft engineers and product teams to identify vulnerabilities across our AI and cloud platforms. Lots of amazing reports and discussions flowed throughout the day—with MSRC, product teams, and the researchers themselves all driving security forward together.

After headshots and hacking, we wrapped the day with a Mariners vs. Tigers game in Seattle (tough loss, but the vibes were strong!).

We’re incredibly grateful to the security researcher community. Your work makes a real impact in helping protect customers.

#ZeroDayQuest

[Microsoft Security Response Center @msftsecresponse]

Here’s a glimpse of last night’s Zero Day Quest welcome reception, where we kicked things off with some of the world’s top security researchers. This invite-only event brings together hackers and Microsoft engineers to collaborate on securing AI and the cloud.

Today, security researchers are onsite at Microsoft’s Redmond campus, diving into our products to uncover vulnerabilities, earn bounty awards, and help protect customers. We’re grateful to have them with us for the Zero Day Quest Onsite Hacking Event.

#ZeroDayQuest

[Microsoft Security Response Center @msftsecresponse]

We had a wonderful evening connecting with some of the incredible security researchers participating in the Microsoft Zero Day Quest Onsite Hacking Event. It’s always inspiring to meet those who dedicate their skills to uncovering and reporting critical vulnerabilities—whether they’ve come from across the globe or just around the corner.

To those still en route: we look forward to welcoming you tomorrow! Thank you for your dedication, talent, and commitment to protecting customers and the world.

#ZeroDayQuest

[Sam Pope @20brokenSP]

@arudd1ck Great work! Conference talk on how you found it? 👀

[Gareth Evans @kryc_uk]

Microsoft is looking for two talented Senior Security Researchers in the U.K. Remote work possible. DMs are open

[Sam Pope @20brokenSP]

@kryc_uk

[Sam Pope @20brokenSP]

@ecthr0s Nice work, Love seeing codeql getting some results!!

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft identified a North Korean threat actor exploiting a zero-day vulnerability in Chromium (CVE-2024-7971) to gain remote code execution. Our assessment of ongoing analysis and observed infrastructure attributes this activity to Citrine Sleet. https://t.co/ITqOQpWn2v

[Johnathan Norman @spoofyroot]

MORSE is growing. I'm building a team in the UK which will focus on Windows VR. Hiring lead and IC roles. Can be 100% remote in the UK or go into the office if you want.
https://t.co/WdoHhAeyTz
https://t.co/07jS7jawKU
https://t.co/K6p5lVoKQZ