Microsoft to hackers: Cash for exploit mitigation inventions
Summary: Microsoft unveils the Blue Hat Prize, a challenge to the security research community to help solve an open problem in exploit mitigation.
LAS VEGAS -- As the annual Black Hat hacker conference kicks off here, Microsoft is turning to the hacker community to help mitigate the Windows platform.
The world's largest software vendor today announced Blue Hat Prize, an academic challenge aimed at generating new ideas for defensive approaches to support computer security. This year, Microsoft is offering $250,000 in cash and prizes to researchers who design a novel one-time mitigation for memory safety vulnerabilities. 
According to Katie Moussouris (right), senior security strategist lead in Microsoft's Trustworthy Computing group, the overall goal is to "solve an open problem in exploit mitigation or significantly improve the effectiveness of existing mitigation solutions."
Microsoft has used several anti-exploit technologies -- like DEP, ASLR, sandboxes, SEHOP and /SAFESEH -- to put up roadblocks for malicious hackers but, in an evolving cat-and-mouse game, researchers continue to publish bypasses and workarounds to defeat those mitigations.
With the Blue Hat Prize, Microsoft is looking to the security research community to help solve an open problem in exploit mitigation or significantly improve the effectiveness of existing mitigation solutions.
Microsoft referenced the cat an mouse game on its challenge web site:
"Two examples of open problems that are suitable for consideration in this challenge are address space information disclosures and return-oriented programming (ROP)."
Moussouris touted the Blue Hat Prize as the largest ever reward offer for defensive technologies and said the company is hoping hackers and researchers in academia will take on the challenge of building software that is resistant to the threats seen on the Windows platform.
"The BlueHat Prize has the potential to provide enhanced security for the Windows operating system, as well as for the applications that run on it, which positively impacts independent software vendors," the company said.
The raw details on what Microsoft is looking for:
- Your Prototype must be submitted as a compressed ZIP no larger than 2 MB containing at least one executable file that demonstrates the solution.
- Your Prototype must solve an open problem in exploit mitigation or significantly improve the effectiveness of existing mitigation solutions. Two examples of open problems that are suitable for consideration in this challenge are address space information disclosures and return-oriented programming (ROP). Note that you are not required to address these and you are not limited to these examples.
- Your Prototype must be fully functioning and work on Windows and be developed using the Microsoft Windows SDK.
- The Prototype must have low overhead meaning CPU and Memory cost of no more than 5%
- Your Prototype must not have any application compatibility or usability regressions
The winner will retain intellectual property ownership of the invention but must agree to offer a royalty-free license to Microsoft.
The judging criteria and technical details on the challenge can be found on the Blue Hat Prize site.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
RE: Microsoft to hackers: Cash for exploit mitigation inventions
Good idea??? Hardly...
A good idea would be to remove all the BS restrictions and let the creativity flow. I think they may have just anal-ed themselves out of some good ideas.
RE: Good idea??? Hardly...
+1 on loosening restrictions...
ESPECIALLY this one: "and be developed using the Microsoft Windows SDK."
RE: Microsoft to hackers: Cash for exploit mitigation inventions
RE: Microsoft to hackers: Cash for exploit mitigation inventions
Why would you need to modify licensing terms, and why run in a VM.
Are there problems with Windows that you need to run in a VM?
RE: Microsoft to hackers: Cash for exploit mitigation inventions
RE: Microsoft to hackers: Cash for exploit mitigation inventions
Funny, I haven't has any problems in terms of security since moving onto Windows Vista and off of XP. The Trustworthy Computing Initiative has worked wonders.
RE: Microsoft to hackers: Cash for exploit mitigation inventions
RE: Microsoft to hackers: Cash for exploit mitigation inventions
Although on the surface, you appear to be right, the fact of the matter is that there are alternative Windows downloads (that are not pirated versions) that you can get for 60-Day periods (might be mistaken in the amount of time). You would essentially become a "tester" for MS, but, then again--you wouldn't.
If you install Windows Server 2008, the hypervisor would be your friend. Within your VMs, you could be able to run as many versions of Windows 7 as you like.
Or, you could simply go the way of the rogue and install pirated versions.
So, in the end, I agree that MS' licensing structure is quite flawed in regards to running multiple VMs...however, if you're going to go through the trouble of running multiple VMs, 1) You should know enough to take advantage of the "semi-open licenses" offered by Microsoft to run their software for x amount of months, 2) You should know enough to incorporate a sandbox in your security arsenal, 3) You should know enough to not put your computer in an exploitative position.
I'm sure that MS' inquiry into this added security approach is less about people comfortable enough with computers to even have this conversation, and more about 1) Throwing Apple's security scoff (circa 2005) back in their face, and 2) helping to protect the non-technical computer user while online.
I agree with kris_... that this should have been their approach years ago. I am at least pleased that with the remnants of their monopolistic empire of the late 90's, that they've begun to use their might for good...at least for now...
RE: Microsoft to hackers: Cash for exploit mitigation inventions
Windows isn't insecure. Windows is target by malware creators because it controls 90% of the market. It's not worth their time to target OS X and Linux, because their market share is so small. It's not financially worth it. Although they are starting to his OS X.
So it has nothing to do with being insecure, as Apple is starting to find out.
RE: Microsoft to hackers: Cash for exploit mitigation inventions
Qubes OS has a home page. Why don't you have a look at the FAQ and Architecture documents before going off the handle? You'll also note that there is no mention of piracy wrt Windows. In fact, Qubes OS is currently in beta and runs Fedora 15 VMs. Windows AppVMs *may* be implemented in the future. And I'm sure that Windows licensing will all be above-board if and when it happens.
RE: Microsoft to hackers: Cash for exploit mitigation inventions
Running any OS in a VM allows you to have and keep a secure version on your hard drive. You can check the status by comparing to a checksum on loading. If a rogue program changes the OS, that change will be gone when you next restart the OS. If you update your OS, or add any program, you just regenerate the checksums before you start a new instance.
Still not foolproof, but it does add an additional layer of protection.
Many Linux users do this routinely. These Linux users are professionally paranoid. Sometimes, that is a very good thing.
For some applications and jobs, paranoia is a job requirement.
RE: Microsoft to hackers: Cash for exploit mitigation inventions
[edited to fix a typo]
RE: Microsoft to hackers: Cash for exploit mitigation inventions
How about "don't allow apps to run as root" and force installed apps to not be part of the OS and execute in completely separate memory space (execute apps in VMs or sandboxes for example, not make OS virtual).
and the A/V makers would cry foul...
Just like they did with Windows 7, when they weren't allowed to install themselves as Kernel modules... which meant major restrictions on what they could do.
RE: Microsoft to hackers: Cash for exploit mitigation inventions
P.S. Qubes OS is considering Windows AppVMs for the future.
RE: Microsoft to hackers: Cash for exploit mitigation inventions
RE: Microsoft to hackers: Cash for exploit mitigation inventions
RE: Microsoft to hackers: Cash for exploit mitigation inventions
Also MS would have to make 64-bit programs more viable to use, such as adding the JIT compiled javascript engine to the 64-bit engine, currently IE x64 javascript is several times slower than the 32-bit one so hardly anyone would use IE x64. Then other browsers would also have to make 64-bit versions viable, but it could be done and eliminate many exploits.
RE: Microsoft to hackers: Cash for exploit mitigation inventions