Microsoft Corp., once known for its tightly controlled, if not opaque, security processes, recently invited a small number of hackers onto its Redmond, Wash., campus to crack the companys products for all to see.
Blue Hat V2 teamed well-known “white hat” hackers with Microsoft employees in an attempt to break into and expose security weaknesses in the companys products. More than 1,000 Microsoft developers, managers and security experts attended, including executives Jim Allchin and Kevin Johnson, co-presidents of the companys Platform Products & Services Division.
The recent Blue Hat event follows a similar gathering held in March at the companys headquarters. Microsoft uses the sessions to teach its developers how malicious hackers view their software and to improve the companys secure development processes, according to Stephen Toulouse, security program manager in the Security Business & Technology Unit at Microsoft.
/zimages/4/28571.gifIs Microsoft a software security trendsetter? Read morehere.
Six ethical, or white hat, hackers attended, including noted security expert Dan Kaminsky; Brett Moore, chief technology officer at Security-Assessment.com Ltd.; and David Maynor, a researcher at Internet Security Systems Inc., Toulouse said.
Maynor, who works for ISS X-Force team in Atlanta, said he showed Microsoft developers and executives how an attacker could use a USB device to load attack code directly into the memory of a Windows machine and force it to run by taking advantage of the DMA (direct memory access) rights assigned by Windows.
“The DMA vector was the most devastating in my talk because it is hard for just Microsoft to address it,” Maynor said. “They need support from hardware vendors as well.”
Maynor said Microsoft is working on a more secure model for handling peripheral devices and may add security checks as a component of the companys USB device-driver signing program in the future.
Kaminsky and others spent years sounding alarm bells about holes in the security defenses of Microsofts software. As a sign of how times have changed, he and other presenters were treated to a lunch with retiring Windows chief Allchin and Johnson.
Maynor said he chatted with Allchin about ways to evade security features in Internet Explorer 7.0, the latest version of the companys browser; ways to cut down on patch distribution time; and techniques for auditing security on Vista, the next version of Windows.
Microsoft will use the information presented at the Blue Hat conference to educate developers within the company. It will also update its SDL (Security Development Lifecycle) architecture.
/zimages/4/28571.gifCheck out eWEEK.coms for Microsoft and Windows news, views and analysis.