At @defcon 33, George Hughey (@ecthr0s) and Rohit Mothe (@rohitwas), Senior Security Research Managers at MSRC, took us back to the 90s with their talk on the ghost of Internet Explorer in Windows: MapUrlToZone.
They uncovered how this legacy API, used by Outlook, Office, Windows Shell, and sandboxes to make security decisions, was vulnerable to manipulation. Their deep dive revealed a dozen CVEs and led to systemic mitigations across Microsoft platforms.
Learn how MSRC’s technical investigations drive proactive protection for customers and why legacy code still matters in the slides available here: https://t.co/DSORcAoePz
#DEFCON #DEFCON33
Looking to hire 2 experienced Security Researchers in the US for the Exploits Research Team within the Microsoft Security Response Center (MSRC)
Senior Security Researcher
https://t.co/po3EwcKeyt
Security Researcher II
https://t.co/iFpxJ4uBIq
This week's Patch Tuesday included 8 CVEs that @rohitwas and I found!
We've been focusing on findings ways to bypass MapUrlToZone and found several very interesting ways to confuse it. This is an API we've seen a lot of interest in lately, so good to have it locked down!
To help protect against NTLM relay attacks, we’ve enabled Extended Protection for Authentication (EPA) by default in Windows Server 2025. This update strengthens key services like Exchange Server, Active Directory Certificate Services (AD CS), and LDAP, making identity compromise and unauthorized access more difficult.
Learn more about these security improvements and how they can help protect your systems in our blog post: https://t.co/Ri1wnV8xkG
MSRC V&M is expanding and is looking for a leader who can guide team of hackers in tackling challenging problems in the areas of Open Source, Supply Chain and Hardware security. If you have the skills and passion for vulnerability management. Apply Now @
https://t.co/3vGh7Lvr7c
@AdmVonSchneider does BinDiff have an option for a patch diff view comparing the HexRays decompiled pseudocode of both binaries? I wasn’t able to last time i used it.. both Diaphora and ghidriff seem to support it
MSRC Vulnerability and Mitigation (V&M) team is expanding into exciting challenges of Open-Source vulnerability response and research. This is an opportunity for you to redefine how Microsoft respond and research in this space. Interested? Apply @ https://t.co/STN0gQjBM7
We have our Microsoft STRIKE Capture the Flag winners! Drumroll, please!🥁
Congrats to the top 3 teams:
🥇JasonsJsons
🥈Capture the Food
🥉0xCAFEBABE
#MSFTSTRIKE
Why is the best defense good offense?
like..why is the best defense not the best offense, how does a superlative in one domain equate to merely “good” in another…
#RandomThoughtsThursday
Yesterday's Patch Tuesday saw the release of 10 CVEs I found in DNS! These could potentially allow an authenticated attacker to gain remote code execution. A huge thank you to the DNS team who worked through and fixed these.
https://t.co/78wxsVh385