Rohit Mothe

Security Re..(dare i say it?) , struggling janitor. tweets,replies,retweets,likes,DMs entirely my own doing, undoing

[Microsoft Security Response Center @msftsecresponse]

At @defcon 33, George Hughey (@ecthr0s) and Rohit Mothe (@rohitwas), Senior Security Research Managers at MSRC, took us back to the 90s with their talk on the ghost of Internet Explorer in Windows: MapUrlToZone.

They uncovered how this legacy API, used by Outlook, Office, Windows Shell, and sandboxes to make security decisions, was vulnerable to manipulation. Their deep dive revealed a dozen CVEs and led to systemic mitigations across Microsoft platforms.

Learn how MSRC’s technical investigations drive proactive protection for customers and why legacy code still matters in the slides available here: https://t.co/DSORcAoePz

#DEFCON #DEFCON33

[George Hughey @ecthr0s]

Super excited @rohitwas and I will be speaking tomorrow about some of the bugs we found in MapUrlToZone @defcon!

[Rohit Mothe @rohitwas]

Looking to hire 2 experienced Security Researchers in the US for the Exploits Research Team within the Microsoft Security Response Center (MSRC)

Senior Security Researcher
https://t.co/po3EwcKeyt

Security Researcher II
https://t.co/iFpxJ4uBIq

[Rohit Mothe @rohitwas]

@ecthr0s happy to see this go out! great change that should mitigate a good chunk of these issues 😊

[George Hughey @ecthr0s]

This week's Patch Tuesday included 8 CVEs that @rohitwas and I found!

We've been focusing on findings ways to bypass MapUrlToZone and found several very interesting ways to confuse it. This is an API we've seen a lot of interest in lately, so good to have it locked down!

[Microsoft Security Response Center @msftsecresponse]

To help protect against NTLM relay attacks, we’ve enabled Extended Protection for Authentication (EPA) by default in Windows Server 2025. This update strengthens key services like Exchange Server, Active Directory Certificate Services (AD CS), and LDAP, making identity compromise and unauthorized access more difficult.

Learn more about these security improvements and how they can help protect your systems in our blog post: https://t.co/Ri1wnV8xkG

[Rohit Mothe @rohitwas]

@SecretlyHidden1 @nullcon @GoogleVRP congrats @SecretlyHidden1 !

[Rohit Mothe @rohitwas]

@arudd1ck awesome find @arudd1ck !

[Rohit Mothe @rohitwas]

@ecthr0s impressive work! u ll cruise past 100 soon

[Rohit Mothe @rohitwas]

@BillDemirkapi word

[Vishal Chauhan @axsdnied]

MSRC V&M is expanding and is looking for a leader who can guide team of hackers in tackling challenging problems in the areas of Open Source, Supply Chain and Hardware security. If you have the skills and passion for vulnerability management. Apply Now @
https://t.co/3vGh7Lvr7c

[Rohit Mothe @rohitwas]

@BillDemirkapi ❤️ did you get the decompiler as well?

[Rohit Mothe @rohitwas]

@AdmVonSchneider does BinDiff have an option for a patch diff view comparing the HexRays decompiled pseudocode of both binaries? I wasn’t able to last time i used it.. both Diaphora and ghidriff seem to support it

[Rohit Mothe @rohitwas]

@symeonp @coalfire @XI_Research congrats!! XI is lucky to grab you, looking forward to seeing more great research

[Rohit Mothe @rohitwas]

@lcamtuf “dream of the 90s is alive in Qualys “ 🎶

[Vishal Chauhan @axsdnied]

MSRC Vulnerability and Mitigation (V&M) team is expanding into exciting challenges of Open-Source vulnerability response and research. This is an opportunity for you to redefine how Microsoft respond and research in this space. Interested? Apply @ https://t.co/STN0gQjBM7

[Microsoft BlueHat @MSFTBlueHat]

We have our Microsoft STRIKE Capture the Flag winners! Drumroll, please!🥁

Congrats to the top 3 teams:
🥇JasonsJsons
🥈Capture the Food
🥉0xCAFEBABE

#MSFTSTRIKE

[Rohit Mothe @rohitwas]

Why is the best defense good offense?

like..why is the best defense not the best offense, how does a superlative in one domain equate to merely “good” in another…

#RandomThoughtsThursday

[Rohit Mothe @rohitwas]

@ecthr0s congrats George! looking forward to the conference talk,wherever it happens to be ;)

[George Hughey @ecthr0s]

Yesterday's Patch Tuesday saw the release of 10 CVEs I found in DNS! These could potentially allow an authenticated attacker to gain remote code execution. A huge thank you to the DNS team who worked through and fixed these.

https://t.co/78wxsVh385