πŸ”’
❌
There are new articles available, click to refresh the page.
Before yesterdayMicrosoft Security Response Center

Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server

30 September 2022 at 06:55
By: msrc
October 5, 2022 updates:Further improvement has been made to the URL Rewrite rule mitigation. Customers should review and use one of these options: Option 1: The mitigation for EEMS rule has been updated and the updates will be applied automatically. Option 2: The mitigation for EOMTv2 has been updated. Option 3: The instructions and image …

Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server Read More Β»

Defense-in-Depth Updates for Azure Identity libraries and Azure Key Vault libraries within Azure SDK plus Best Practice Implementation Guidance

20 September 2022 at 17:17
By: msrc
Summary Today, Microsoft released new versions of the Azure Key Vault libraries and Azure Identity libraries as part of the Azure Software Development Kit (SDK) that includes defense-in-depth feature improvements. We also published best practice guidance to help protect applications and services that allow externally controlled input into the Azure Key Vault client URI for …

Defense-in-Depth Updates for Azure Identity libraries and Azure Key Vault libraries within Azure SDK plus Best Practice Implementation Guidance Read More Β»

Curious, Innovative, Creative, Community Driven: Meet Cyb3rWard0g, Roberto Rodriquez

When I grow up I want to be? Dancer or a veterinarian Happiest memories: Tearing up the dance floor at weddings and playing soccer in the streets of Lima, Peru Previous Job roles: Mopped floors for McDonalds, packed boxes at an Avon warehouse, Manager at Olive Garden, Beer taster/server and then dove into tech and …

Curious, Innovative, Creative, Community Driven: Meet Cyb3rWard0g, Roberto Rodriquez Read More Β»

What’s the smallest variety of CHERI?

6 September 2022 at 08:09
The Portmeirion project is a collaboration between Microsoft Research Cambridge, Microsoft Security Response Center, and Azure Silicon Engineering & Solutions. Over the past year, we have been exploring how to scale the key ideas from CHERI down to tiny cores on the scale of the cheapest microcontrollers. These cores are very different from the desktop …

What’s the smallest variety of CHERI? Read More Β»

Vulnerability Fixed in Azure Synapse Spark

1 September 2022 at 15:00
By: msrc
Summary: Microsoft takes a proactive approach to continually probe our defenses, hunt for vulnerabilities, and seek new, innovative ways to protect our customers. Security researchers are an important part of this effort, and our collaborative partnership is critical in a world where cybersecurity attacks continue to grow in number and sophistication.Β  We value the role …

Vulnerability Fixed in Azure Synapse Spark Read More Β»

Microsoft Bug Bounty Programs Year in Review: $13.7M in Rewards

11 August 2022 at 16:00
By: msrc
The Microsoft Bug Bounty Programs and partnerships with the global security research community are important parts of Microsoft’s holistic approach to defending customers against security threats. Our bounty programs incentivize security research in high-impact areas to stay ahead of the ever-changing security landscapes, emerging technology, and new threats. Security Researchers help us secure millions of …

Microsoft Bug Bounty Programs Year in Review: $13.7M in Rewards Read More Β»

Security Update Guide Notification System News: Create your profile now

9 August 2022 at 17:20
By: msrc
Sharing information through the Security Update Guide (SUG) is an important part of our ongoing effort to help customers manage security risks and keep systems protected. In January 2022 we introduced Phase One of a new way for customers to receive email notifications about new Microsoft product security content using any email address, not just …

Security Update Guide Notification System News: Create your profile now Read More Β»

Congratulations to the MSRC 2022 Most Valuable Researchers!

8 August 2022 at 17:30
By: msrc
The Microsoft Researcher Recognition Program offers public thanks and recognition to security researchers who help protect our customers through discovering and sharing security vulnerabilities under Coordinated Vulnerability Disclosure.Β  Today, we are excited to recognize this year’s top 100 Most Valuable Researchers (MVRs) based on the total number of points earned for each valid report. Congratulations …

Congratulations to the MSRC 2022 Most Valuable Researchers! Read More Β»

Microsoft Office to publish symbols starting August 2022

8 August 2022 at 09:30
By: msrc
We are excited to announce that Microsoft Office will begin publishing Office symbols for Windows via the Microsoft Public Symbol Server on August 9th 2022. The publication of Office symbols is a part of our continuing investment to improve security and performance for customers and partners. Key Advantages for customers, partners, and Microsoft Security: Empowering …

Microsoft Office to publish symbols starting August 2022 Read More Β»

Anatomy of a Cloud-Service Security Update

Our security teams around the world focus on identifying and mitigating security issues as soon as possible while minimizing customer disruption. One of the challenges of a traditional security update is ensuring customers apply the protections promptly. We recently discussed the work that goes into these updates in The Anatomy of a Security update.Β  Cloud …

Anatomy of a Cloud-Service Security Update Read More Β»

Congratulations to the Top MSRC 2022 Q2 Security Researchers!

19 July 2022 at 16:15
By: msrc
Congratulations to all the researchers recognized in this quarter’s Microsoft Researcher Recognition Program leaderboard! Thank you to everyone for your hard work and continued partnership to secure customers. The top three researchers of the 2022 Q2 Security Researcher Leaderboard are: Yuki Chen, Zhiyi Zhang, and William SΓΆderberg! Check out the full list of researchers recognized …

Congratulations to the Top MSRC 2022 Q2 Security Researchers! Read More Β»

Mitigation for Azure Storage SDK Client-Side Encryption Padding Oracle Vulnerability

18 July 2022 at 13:40
By: msrc
Summary: Google informed Microsoft under Coordinated Vulnerability Disclosure (CVD) of a padding oracle vulnerability that may affect customers using Azure Storage SDK (for Python, .NET, Java) client-side encryption (CVE-2022-30187). To mitigate this vulnerability, we released a new General Availability (GA) version of the Azure Storage SDK client-side encryption feature (v2) on July 12, 2022. Microsoft …

Mitigation for Azure Storage SDK Client-Side Encryption Padding Oracle Vulnerability Read More Β»

All Hands-on Deck: A Whole-of-Society Approach for Cybersecurity

The morning of June 9th, I was driving over the Golden Gate Bridge into San Francisco with my family. While crossing the bridge my children shared some facts about this modern engineering marvel. Each day, approx. 100,000 vehicles travel over the bridge deck, which weighs a staggering 150,000 tons, and is suspended by 250 pairs …

All Hands-on Deck: A Whole-of-Society Approach for Cybersecurity Read More Β»

Microsoft Mitigates Azure Site Recovery Vulnerabilities

12 July 2022 at 17:49
By: msrc
Summary: Microsoft recently mitigated a set of vulnerabilities in Azure Site Recovery (ASR) and released fixes today, July 12, as part of our regular Update Tuesday cycle. These vulnerabilities affect all ASR on-premises customers using a VMware/Physical to Azure scenario and are fixed in the latest ASR 9.49 release. We recommend customers update to the …

Microsoft Mitigates Azure Site Recovery Vulnerabilities Read More Β»

Service Fabric Privilege Escalation from Containerized Workloads on Linux

28 June 2022 at 23:35
By: msrc
Under Coordinated Vulnerability Disclosure (CVD), cloud-security vendor Palo Alto Networks informed Microsoft of an issue affecting Service Fabric (SF) Linux clusters (CVE-2022-30137). The vulnerability enables a bad actor, with access to a compromised container, to escalate privileges and gain control of the resource’s host SF node and the entire cluster. Though the bug exists on …

Service Fabric Privilege Escalation from Containerized Workloads on Linux Read More Β»

A Man of Action: Meet Callum Carney

Hidden Talents: He was a competitive swimmer for many years. Instrument of Choice: His fingers were made for the keyboard, but he used to play the trumpet. 5 pieces of entertainment for the rest of his life: The Office, World War Z, The Matrix, Breaking Bad, The Thick of It. Favorite non-profit: RSPCA How he …

A Man of Action: Meet Callum Carney Read More Β»

Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability

30 May 2022 at 23:25
By: msrc
UPDATE July 12, 2022: As part of the response by Microsoft, a defense in depth variant has been found and fixed in the Windows July cumulative updates. Microsoft recommends installing the July updates as soon as possible. Windows Version Link to KB article LInk to Catalog Windows 8.1, Windows Server 2012 R2 5015805 Download Windows …

Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability Read More Β»

New Research Paper: Pre-hijacking Attacks on Web User Accounts

In 2020, MSRC awarded two Identity Project Research Grants to support external researchers working to further strengthen the security of identity protocols and systems. Today we are pleased to release the results of the first of these projects. This research, led by independent security researcher Avinash Sudhodanan, investigated account pre-hijacking – a new class of …

New Research Paper: Pre-hijacking Attacks on Web User Accounts Read More Β»

Researcher Spotlight: Hector Peralta’s Evolution from Popcorn Server to the MSRC Leaderboards

β€œThe bug bounty literally changed my life. Before this, I had nothing.” Coolest thing he purchased: His first vehicle! Best gift to give: Buying his nephew gaming accessories. Favorite Hacking Companion: His two cats. They’re always by his side when he is working late. Origin of his Hacker name: The word dog in Spanish is …

Researcher Spotlight: Hector Peralta’s Evolution from Popcorn Server to the MSRC Leaderboards Read More Β»

❌