Microsoft has hired yet another well-known security researcher to join its ever-growing team of exploit and defense experts. This time it’s Ken Johnson, known in the hacker world as Skywing. Johnson is known as an expert on debugging and reverse engineering, and has done a tremendous amount of work tearing apart Windows defenses specifically.
Before moving to Microsoft, Johnson was working for Positive Networks, a VPN provider. In a blog post announcing Johnson’s hiring, Microsoft software security guru Mike Howard praised Johnson’s experience and skill.
“Ken brings an enormous amount of reverse engineering and defense-subversion skill to Microsoft. Ken will be working on anything and everything related vulnerabilities, exploits, defenses, bypassing defenses and more,” Howard said.
Johnson’s hiring is the latest in a series of interesting personnel moves for Microsoft’s security group. The changes essentially began about three years ago when Adam Shostack joined Microsoft. Shostack is a well-known security and privacy expert and had spent years in start-ups and smaller organizations and was not afraid to be critical of Microsoft’s policies.
“In the past, I’ve heaped scorn on Microsoft’s security related decisions. Over the last few years, I’ve watched Microsoft embrace security. I’ve watched them make very large investments in security, including hiring my friends and colleagues. And really, I’ve watched them produce results,” Shostack wrote in a blog post at the time of his hiring at Microsoft.
Then in January 2008 Microsoft hired Crispin Cowan, an expert on Linux and open-source security and was the brains behind the Immunix security-enhanced Linux distribution. And a few months later Matt Miller joined Microsoft, as well. Known as Skape, Miller was a big part of HD Moore’s Metasploit Project team and is known for his work on exploitation techniques.
Given the emphasis that Microsoft has placed on anti-exploitation and memory protection in its most recent releases, including Vista and Internet Explorer 8, it stands to reason that the company will continue to bring in more of the people who have done work on the other side of that fence. There’s no defense like a good offense.
