This month’s Patch Tuesday security bulletins called attention to vulnerabilities in the Windows kernel’s font-processing engine, which had been exploited previously in Duqu and other targeted attacks.
Browsing Category: Microsoft
Just a few weeks after announcing its first bug bounty programs, Microsoft is already set to pay out a reward to a researcher from Google who discovered a vulnerability in Internet Explorer 11.
Attackers are using an Internet Explorer vulnerability, which Microsoft patched yesterday, in targeted attacks that also employ a malicious Flash file installed through a drive-by download launched by compromised Web pages. The exploit that’s being used is capable of bypassing both ASLR and DEP.
Bug bounty programs can be as much as 100 times more cost-effective for finding security vulnerabilities than hiring full-time security researchers to do the same thing. New research from the University of California at Berkeley, which focused on bug bounty programs run by Google and Mozilla, found that each of these programs has cost the vendor about $400,000 over the course of three years, far less than it would’ve cost to hire employees to find the same number of vulnerabilities.
Microsoft’s July Patch Tuesday security bulletins patch numerous critical vulnerabilities, including some related to malicious TrueType Font files used in a number of high-profile targeted attacks.
The Microsoft Malware Protection Center reports of unusual behavior from the Vobfus and Beebone malware families where each malware variant continuously downloads a version of the other.
Dennis Fisher talks with Ryan Naraine about the new Microsoft bug bounty program, how it may affect prices for vulnerabilities on the private market and why it took the company so long to start the reward program.
The Microsoft bug bounty program has been nearly a decade in the making and it is clear from the shape and size of it that the company did not simply slap the program together in order to join the cool kids. Microsoft’s security team spent years watching the way other programs work, seeing what incentives attract good researchers and looking for a system that made sense for Microsoft’s specific goals.
After years of saying that the company didn’t need a bug bounty program, Microsoft is starting one. The company today will announce the start of a new program that will pay security researchers up to $100,000 for serious vulnerabilities and as much as $50,000 for new defensive techniques that help protect against those flaws.
Despite a rating of “Important,” a Microsoft Office 2003 zero-day vulnerability and patch deserve a close look from enterprise IT administrators.