Security @ Microsoft & BlueHat Podcast Co Host

Endor
Joined February 2014
Wendy retweeted
A Scottish Highland cow, just 2 hours old. 🤗🤗
1,527
11,805
1,108
147,465
4,087,768
98
1,295
94
19,255
594,191
330
18,957
495
102,604
1,992,072
At an aquarium in Japan, after closing time, some clever little otter pups help their grandpa tidy up their toys. As a reward, he gives them ice cubes
1,695
30,541
1,983
264,777
9,997,702
🎤 BlueHat Redmond speaker announcement We're excited to announce Varsha Chahal and Henrique Pereira (@ikkebr), Senior Security Engineers at Microsoft, will be speaking at BlueHat Redmond with their talk, “Gotta Catch’em All: Hunting Azure Anonymous Functions in the Wild.” Azure Functions often expose anonymous HTTP endpoints, creating a broad and overlooked attack surface. In this session, Varsha and Henrique share how they identified and exploited vulnerabilities at scale, leading to 40+ MSRC cases, including multiple high-impact issues. From CodeQL to automated exploitation pipelines, learn how small misconfigurations can turn into critical cloud risks and how defenders can better secure serverless workloads. #BlueHat
3
9
653
There is a lot of momentum around AI in cybersecurity and its ability to improve security outcomes at scale. At Microsoft, we are applying these capabilities to our long-standing work with the community to find and mitigate vulnerabilities more quickly and augmenting our security and development toolsets so we can better protect customers and Microsoft. Read more: msft.it/6011QNHuf
5
2
9
6,857
All those XSS payloads… and @secbughunter still beat them by just handing over a cookie 🍪😄 Day 2 of #ZeroDayQuest @msftsecresponse
1
2
9
2,455
In our latest blog, Cameron Vincent (@SecretlyHidden1), Senior Security Researcher at MSRC, features the work of MSRC intern and security researcher, Brian McNulty (@brianjmcnulty), who uncovered 22+ critical vulnerabilities in just two months. Learn how the MSRC team leverages automation and tools like IMPOSTR to identify risky multi-tenant apps, why robust authentication and authorization are essential, and how new protocols like Model Context Protocol (MCP) are shaping the future of secure AI integration. This blog covers: • Real-world attack scenarios and variant hunting strategies • Securing multi-tenant authentication and authorization flows • Lessons learned from MCP vulnerabilities and Azure template exposures If you’re a security researcher, CISO, or technical leader interested in advanced detection techniques and evolving best practices, see how MSRC is raising the bar for proactive defense. Read the full blog post here: msft.it/6011tzx2V
1
10
1
36
6,921
We’re excited to announce our next BlueHat Asia speakers: Brian McNulty (@brianjmcnulty) and Cameron Vincent (@SecretlyHidden1)! Cameron is a Senior Security Researcher at Microsoft, specializing in vulnerabilities and mitigation within MSRC. From reproducing bug reports to variant hunting, Cameron has spent the last decade identifying and mitigating trends to protect the Microsoft ecosystem. His research focuses on authentication and authorization vulnerabilities, an area he’s been passionate about for over 10 years. Brian began making a name for himself through Meta’s bug bounty program and is just getting started. Currently a student at the University of Michigan, Brian has proven his skills as a 2025 MSRC intern and as a top player in the bug bounty world, ranking in Meta’s top 5 multiple times. He’s also working toward his master’s in computer science, continuing to push boundaries in security research. Their upcoming talk will take you inside the MSRC Vulnerabilities & Mitigations team, exploring how variant hunting and deep issue analysis help secure the Microsoft ecosystem. #BlueHatAsia
4
1
12
3,227
Microsoft’s Zero Day Quest is back and bigger than ever. Last year, we launched the largest public hacking event in history, and the global security community responded with incredible energy and expertise. We’re increasing our commitment with up to $5 million in total bounty awards for high-impact research in cloud and AI security. Learn more about how you can participate in the Zero Day Quest Research Challenge and qualify for our exclusive Live Hacking Event in Redmond: msft.it/6010szF6y #ZeroDayQuest
31
4
84
22,607
At @defcon, the MSRC team had a great time connecting with the security community and cheering on Microsoft employees, MVRs, and other Microsoft security researchers as they shared their expertise through presentations and hands-on collaboration. #DEFCON #DEFCON33
2
4
23
5,570
One week ago, we came together at the MSRC Researcher Celebration during Black Hat to honor the incredible community that helps keep Microsoft secure. From meaningful conversations to Clippy through the decades on display, it was a night to connect and celebrate your contributions. Thank you to everyone who joined us. You’re the reason we do what we do. #BHUS
1
6
21
8,058
Big congratulations to Microsoft Most Valuable Researcher (MVR) Brad Schlintz @nmdhkr and his ?Cube CTF team, 2_minutes_faster, for earning the coveted Black Badge at DEF CON 33! This multi-discipline hacking competition challenged participants in Physical Breach Techniques, Web Application Hacking, Cryptography, Malware Reverse Engineering, Command and Control, Steganography, Phreaking, and more. Last year, the team missed the win by just two minutes in a tiebreaker. This year, they came back faster, stronger, and victorious. Team 2_minutes_faster: • Brandon Kraycirik • Nadia Chigmaroff • Caroline Jordan • Nathan Reyes • Paul Pongsuphat • Patrick Raiden • Brad Schlintz Your persistence and skill embody the best of the security community. Congratulations on this incredible achievement! Learn more about the ?Cube CTF: msft.it/6012srLo8 hashtag#defcon hashtag#defcon33
4
29
5,738
We’re proud to partner with Microsoft Most Valuable Researchers (MVRs) like Azure Yang (@4zure9) from Cyber Kunlun, whose collaboration has driven meaningful changes in Windows Secure boot. At Black Hat, Azure shared research exploring remote attack surfaces in the Windows boot process, helping Microsoft identify and address complex technical challenges in Secure Boot, including areas like network protocols, registry handling, and filesystem logic. This work highlights the critical role the security research community plays in protecting customers. #BHUSA
7
1
62
9,173
The Call for Papers is now open for BlueHat Asia in Bengaluru, India, taking place on November 5 - 6, 2025! This is your chance to showcase your thought leadership in vulnerability and mitigation, emerging security threats and techniques, novel research findings, calls-to-action for the security community, and more. ⬇️Submit your paper by September 5 ⬇️ aka.ms/bhasia25cfp Here are some suggested topics to inspire your submission (but don’t feel limited by them—we’re excited to see what you bring to the community!): ▸AI, Machine Learning, & Data Science ▸Applied Cryptography ▸Cybersecurity Careers ▸Cybersecurity Policy ▸Data Forensics & Incident Response ▸Detection Techniques at Scale ▸Exploit Development ▸Human Factors ▸IoT/OT & Critical Infrastructure Security ▸Physical Security ▸Quantum Security ▸Red Team/Blue Team Lessons Learned ▸Reverse Engineering ▸Virtualization and Container Security Don’t miss this opportunity to be part of BlueHat Asia. #BlueHatAsia
3
3
13
24,336
Registration for the Cyber-Security Brazilian Jiu-Jitsu Smackdown (2025) is open! Held between @BlackHatEvents and @defcon (Thur, Aug 7), 60 of us step onto the mat for the most fun and epic experience. Former UFC Champion @ForrestGriffin is our head instructor, accompanied by several more elite pros. First-timers always welcomed! Reg: eventbrite.com/e/cyber-secur… 2024 Video: youtube.com/watch?v=vT5WMpcY… Sponsored by: @nucleussec and @wirespeed_
5
1
9
2,211
From MS-DOS to Copilot, we’ve come a long way. This year, in honor of Microsoft’s 50th anniversary, MSRC is throwing it back (way back) with a "Microsoft Through the Decades" security researcher celebration during Black Hat. 🗓 August 7, 2025 📍Skyfall Lounge, W Las Vegas This invite-only event brings together members of the security community who’ve helped protect Microsoft across generations of tech. Apply to attend: msft.it/6013S2JkU #MSFTBlackHat #BHUSA
4
8
1
22
10,628
Day 2 of #ZeroDayQuest brought even more hacking, problem-solving, and unforgettable moments. We then went to Carmine’s for incredible food and even better conversation, connecting over exploits, defense strategies, and a shared passion for protecting customers.
1
12
1
27
6,377
These ZDQ shoes are pure 🔥! Walking the hacker path in style! #ZeroDayQuest @msftsecresponse
1
11
582