George Hughey

Security Researcher at Microsoft WARP

[George Hughey @ecthr0s]

Check out the talk here: https://t.co/LiUkZMHWnK

[George Hughey @ecthr0s]

Super happy to see the blog post and Defcon talk go live!!! These are some of my proudest finds 😊

[Microsoft Security Response Center @msftsecresponse]

Ever wondered how Windows decides if a file path is local, intranet, or Internet, and why it matters for security? Our latest blog from MSRC Senior Security Research Managers George Hughey (@ecthr0s) and Rohit Mothe (@rohitwas) dives deep into MapUrlToZone (MUTZ), the critical Windows component that helps protect users from credential leaks and remote code execution.

In this blog, you’ll learn:
➤ How MUTZ works behind the scenes
➤ Real-world vulnerabilities and CVEs discovered by Microsoft researchers
➤ The latest fixes and what they mean for Windows security

Check out our latest blog post and see how MSRC is strengthening defenses for everyone: https://t.co/acEVhEhPUe

[George Hughey @ecthr0s]

@brianjmcnulty Congrats Brian!! Can't wait to see it :)

[CyberPatriot @CyberPatriot]

Congratulations to George Hughey, the CyberPatriot XV Mentor of the Year!

[Microsoft Security Response Center @msftsecresponse]

At @defcon 33, George Hughey (@ecthr0s) and Rohit Mothe (@rohitwas), Senior Security Research Managers at MSRC, took us back to the 90s with their talk on the ghost of Internet Explorer in Windows: MapUrlToZone.

They uncovered how this legacy API, used by Outlook, Office, Windows Shell, and sandboxes to make security decisions, was vulnerable to manipulation. Their deep dive revealed a dozen CVEs and led to systemic mitigations across Microsoft platforms.

Learn how MSRC’s technical investigations drive proactive protection for customers and why legacy code still matters in the slides available here: https://t.co/DSORcAoePz

#DEFCON #DEFCON33

[Microsoft Security Response Center @msftsecresponse]

At @defcon, the MSRC team had a great time connecting with the security community and cheering on Microsoft employees, MVRs, and other Microsoft security researchers as they shared their expertise through presentations and hands-on collaboration.

#DEFCON #DEFCON33

[George Hughey @ecthr0s]

Super excited @rohitwas and I will be speaking tomorrow about some of the bugs we found in MapUrlToZone @defcon!

[George Hughey @ecthr0s]

@HaifeiLi @nachoskrnl He gave us a lot of insights! There were many late nights reading his blogs

[George Hughey @ecthr0s]

This week's Patch Tuesday included 8 CVEs that @rohitwas and I found!

We've been focusing on findings ways to bypass MapUrlToZone and found several very interesting ways to confuse it. This is an API we've seen a lot of interest in lately, so good to have it locked down!

[George Hughey @ecthr0s]

We're super proud of this work - it took a lot of poking around in Windows Internals and a huge effort from Engineering to fix all these issues. Many thanks to all who worked on these :)

[George Hughey @ecthr0s]

As many of these exploit differences in CreateFile and MUTZ, we've duplicated some of the behavior in CreateFile. This should help prevent similar bypasses in the future. We're planning on releasing more info about this research over the coming months, so stay tuned!

[Microsoft Security Response Center @msftsecresponse]

To help protect against NTLM relay attacks, we’ve enabled Extended Protection for Authentication (EPA) by default in Windows Server 2025. This update strengthens key services like Exchange Server, Active Directory Certificate Services (AD CS), and LDAP, making identity compromise and unauthorized access more difficult.

Learn more about these security improvements and how they can help protect your systems in our blog post: https://t.co/Ri1wnV8xkG

[George Hughey @ecthr0s]

@rohitwas Probably cuz you keep showing me how to find them 😉

[George Hughey @ecthr0s]

My 50th CVE came out in today's Patch Tuesday! CVE-2024-38240 is the last of some hardening we've been doing in a Windows service, and CVE-2024-38252/CVE-2024-38253 are two proactive efforts we worked on with some static analysis friends :)

[dragosr @dragosr]

CanSecWest Presentation:

Rolling in the Dough: How Microsoft Identified and Remediated a Baker’s Dozen of Security Threats in the Windows DNS Server

George Hughey, Microsoft

https://t.co/0wkkZ7tzu2

[George Hughey @ecthr0s]

@20brokenSP Let's go Sam!!

[George Hughey @ecthr0s]

@stack__trace You should buy it and see if it gets back to you

[George Hughey @ecthr0s]

I'm hoping to give a conference talk/blog post on the DNS Admin research, methodology, and fix process we've been doing soon(ish), so stay tuned!

[George Hughey @ecthr0s]

Yesterday's Patch Tuesday saw the release of 10 CVEs I found in DNS! These could potentially allow an authenticated attacker to gain remote code execution. A huge thank you to the DNS team who worked through and fixed these.

https://t.co/78wxsVh385