Jonas Vestberg

Privilege Escalation Engineer

Principal Consultant @ Reversec (formerly WithSecure Consulting)

[Jonas Vestberg @bugch3ck]

@UK_Daniel_Card

[Jonas Vestberg @bugch3ck]

@NathanMcNulty I know, let's rename it AppContAIners and watch to flourish.

[Jonas Vestberg @bugch3ck]

@_dirkjan Oh that time, when you literally owned everyone using Entra...

[Microsoft Security Response Center @msftsecresponse]

Over the past several days, we have been listening to the conversation around coordinated disclosure and the relationship between security researchers and vendors. We recognize that this relationship is both critical and, at times, fragile. We deeply value the security community, and will continue to take your feedback seriously.

To be clear about our approach to legal matters, we have no intention to pursue action against individuals conducting or publishing their security research. When an individual breaks the law and engages in malicious activity causing real harm to our customers, we will work with law enforcement as appropriate.

We recognize the work that goes into researching and submitting a vulnerability. We are committed to approaching every interaction with transparency, clear communication, and professionalism. We continue to believe strongly in Coordinated Vulnerability Disclosure as the foundation for protecting customers and improving our products. Each year we process a high volume of vulnerability reports. That volume continues to grow and will continue with the rise of AI-enabled research. We acknowledge that some interactions have fallen short and are working to learn from them.

Many of us have experience on both sides of this work, as researchers reporting vulnerabilities and as responders triaging and assessing them. That perspective informs how we approach this feedback and the importance we place on getting it right, particularly as the volume and complexity of research continues to grow.

The security community plays a vital role in helping us protect customers. We are committed to maintaining a constructive and respectful relationship and growing together. We know that, given the nature of this work, there will at times be misunderstandings. We remain committed to engaging in good faith and to providing a respectful and professional experience for all researchers, regardless of past interactions.

[Jonas Vestberg @bugch3ck]

@Theolojism @midwestneil No way, that's Eminem...

[Jonas Vestberg @bugch3ck]

@sekurlsa_pw Yes it's a really bad, almost dishonest, behavior. Microsoft should know better.

Acknowledge the vuln with low priority/severity. Just don't lie to researchers.

[Jonas Vestberg @bugch3ck]

@HackingDave Hey man you are a great dad but let that kid learn life's lessions without it being announced all over Twitter.

[Volodymyr Zelenskyy / Володимир Зеленський @ZelenskyyUa]

Ukraine knows how to do the right thing.

Thank you, Sweden!

[Jonas Vestberg @bugch3ck]

@kaijieguigui Nice masking there 😂

MIDISrvLPE.exe is clearly visible...

[Volodymyr Zelenskyy / Володимир Зеленський @ZelenskyyUa]

Tack Sverige! Tack @SwedishPM! Ära åt Ukraina!

🇺🇦🇸🇪

Дякую, Швеціє! Дякую, Ульфе! Слава Україні!

🇺🇦 🇸🇪

Thank you, Sweden! Thank you, Ulf! Glory to Ukraine!

[Jonas Vestberg @bugch3ck]

@merill @ThePrimeagen From your time at Microsoft? 🍿

[DriftNeural @driftneuralllc]

@GabrielLandau they spanked me for an rce, straight clowns. they did they same to me than switched up after saying it was in scope. had a dependency confusion on bing and popped a shell

[Jonas Vestberg @bugch3ck]

@driftneuralllc @GabrielLandau That's why I never submit to bug bounties anymore...

The real reason is that the bugs I find is never in scope anyway, and you can't make a living from bug bounties anyway 😆

Just like the music business. You can only make a living of it if you are a rockstar 🤘

[Jonas Vestberg @bugch3ck]

@driftneuralllc @GabrielLandau Bing, as in the search engine Bing?

[Jonas Vestberg @bugch3ck]

@podalirius_ Seems like Microsoft's bug bar is "too shallow". They should assign CVEs for vulnerabilities with low exposure or non-default exploit conditions in order for their clients to keep track of changes in behavior that could affect their ability to protect their assets.

[Jonas Vestberg @bugch3ck]

@rootsecdev The new Responsible Disclosure Process is to use the vuln in as many Red Team engagements as you can before dropping it on GitHub when it gets burned.

jk

[🕳 @sekurlsa_pw]

More info about this vulnerability including POC generator
https://t.co/Te1AcOBGUj

[Jonas Vestberg @bugch3ck]

@SpecterOps @securityfest

[Jonas Vestberg @bugch3ck]

@_xpn_ @olafhartong The missing ingredient was... Nazis?