Michael Hendrickx

Security Research at Microsoft, in my spare time I try to ████████████ but █████ has done ████ to it. Making beats drop and calc.exe's pop. :)

[Microsoft Security Response Center @msftsecresponse]

Thank you to everyone who joined us for the MSRC Researcher Celebration at Black Hat Europe. It was wonderful to spend an evening with so many members of the security research community sharing conversations, ideas, and a lot of fun.

We’re grateful for the partnerships and relationships that drive this community forward. Here’s to the work we do together and the future we’re building.

#BHEU

[Paul Asadoorian @[email protected] @securityweekly]

I miss the days of "ifconfig" and "eth0", but I've come to accept that Linux environments are constantly changing. This is why it is essential to keep notes on command syntax and related topics; even a couple of Google Docs can be really helpful!

[Microsoft Security Response Center @msftsecresponse]

At @defcon 33, George Hughey (@ecthr0s) and Rohit Mothe (@rohitwas), Senior Security Research Managers at MSRC, took us back to the 90s with their talk on the ghost of Internet Explorer in Windows: MapUrlToZone.

They uncovered how this legacy API, used by Outlook, Office, Windows Shell, and sandboxes to make security decisions, was vulnerable to manipulation. Their deep dive revealed a dozen CVEs and led to systemic mitigations across Microsoft platforms.

Learn how MSRC’s technical investigations drive proactive protection for customers and why legacy code still matters in the slides available here: https://t.co/DSORcAoePz

#DEFCON #DEFCON33

[Microsoft Security Response Center @msftsecresponse]

Thank you to everyone who joined us at the MSRC Researcher Celebration during #BHUSA last night. It was incredible to see so many members of the security community come together to share stories and build connections. Special shoutout to our 2025 MSRC MVRs for being part of this amazing event.

Here’s to the friendships, the collaborations, and the future we’re shaping together.

#MSFTBlackHat

[Microsoft Security Response Center @msftsecresponse]

Day 1 of the Zero Day Quest Onsite Hacking Event is in the books and we’ve kicked off Day 2.

We welcomed top security researchers from around the world to Microsoft’s Redmond campus for a day of live hacking, collaboration, and connection.

Researchers worked side-by-side with Microsoft engineers and product teams to identify vulnerabilities across our AI and cloud platforms. Lots of amazing reports and discussions flowed throughout the day—with MSRC, product teams, and the researchers themselves all driving security forward together.

After headshots and hacking, we wrapped the day with a Mariners vs. Tigers game in Seattle (tough loss, but the vibes were strong!).

We’re incredibly grateful to the security researcher community. Your work makes a real impact in helping protect customers.

#ZeroDayQuest

[Microsoft Security Response Center @msftsecresponse]

Cameron Vincent @SecretlyHidden1, Security Researcher at Microsoft, gave a talk about IDOR vulnerabilities to a packed room at @nullcon #Goa. Cameron discussed how broken access control has been the top problem across the ecosystem for a while. Camerons research into IDOR vulnerabilities was manual, without extensions or automation, although he recommends using Burp Suite, which = the golden tool.

#NullconGoa2025 #Nullcon

[Theo - t3.gg @theo]

This is one of the wildest git diffs I've ever seen

[Microsoft Security Response Center @msftsecresponse]

The MSRC team is excited to be at @nullcon #Goa! Come find us to chat about our bug bounty programs, @MSFTBlueHat India, job opportunities, and more.

#NullconGoa2025 #nullcon

[Michael Hendrickx @ndrix]

@DrAzureAD That's a blanket statement

[Michael Hendrickx @ndrix]

@HackenProof You'd have 10 years of more life experience and unique perspectives than a 20 year old. ;) It's never too late.

[Michael Hendrickx @ndrix]

huh? Is the response supposed to only include private code?

[Michael Hendrickx @ndrix]

@SravanAkkaram Welcome to Microsoft, looking forward to working together! :)

[Michael Hendrickx @ndrix]

Verifying myself: I am ndrix on https://t.co/yNFBc83Y7t. yr9_VIDIPljkPhwlcnkC5xerQbENgrPgjIaQ / https://t.co/VXILUh6IP8

[Michael Hendrickx @ndrix]

@stokfredrik but.. hackers without sunglasses... j/k, family time is most important! Enjoy!

[Michael Hendrickx @ndrix]

@bookingcom At least be transparent who you subcontract the a tual work to, so we can expect crappy customer service. You're a USD 130B+ company, invest some in customer service next quarter.

[Michael Hendrickx @ndrix]

I don't rant much about businesses, but @bookingcom is a pretty crappy experience. Booking.nope from now on.

[Michael Hendrickx @ndrix]

@bookingcom this has been going on for a week, seems you subcontract all to https://t.co/8Gj3TNHAPY, a site that's slammed on reddit, google et al to be fraudulent and a scam.

[Michael Hendrickx @ndrix]

@shenetworks 🙋🏼‍♂️

[@mikko @mikko]

Does anyone else find this to be very cool?

[Michael Hendrickx @ndrix]

@CaptPegLeg74 @defcon happy birthday!