Notably absent from the party were most of Microsofts top security executives. Taking up the slack was the staff of the MSRC, which has turned over quite a bit in the last year. Once run mainly by senior Microsoft managers, the MSRC now is made up of a much younger crop of security specialists who are perhaps better suited to the task of working with and relating to the researchers who make it their business to find weaknesses in the companys software. Many of the researchers in the crowd have been among Microsofts chief tormenters for the last few years. Maiffret and eEye have built their reputation on digging out vulnerabilities in the Microsofts products, including the flaw that was exploited by the infamous Code Red worm two years ago. Wysopal, as a member of the famed L0pht hacking collective, spent considerable time hammering on Microsofts products. And Litchfield and Larholm both have become well-known for their research on a variety of fronts.Looking around the bar, it was difficult to believe how friendly and cordial everyone was being, said Maiffret, who early in his career drew the wrath of Redmond for including exploit code in some of eEyes vulnerability advisories. The company has long since stopped releasing exploits, and Maiffret and his crew were happily trading stories with their opposite numbers in the MSRC. None of which is to imply that these researchers have suddenly gone soft on Microsoft. Quite the contrary in fact. Many of the attendees spent considerable time explaining to MSRC staffers what the company could do to improve its response process and where its blind spots are. But, by the time the doors were thrown open to the Ghostbar regulars (read: NBA players, celebrities and their posses) and a mob of MSRC folks piled into a stretched-out and blacked-out SUV limo with a band of researchers instead of riding off with the Four Horsemen, it was clear that times were indeed a-changin.
So, to see these folks mingling, drinking, and yes, even laughing, with the Microsoft employees was odd to say the least. The weirdness was not lost on anyone on either side of the equation.