Security Researcher at Microsoft WARP
Seattle, WA
Joined June 2018
- Tweets67
- Following193
- Followers592
- Likes151
Super happy to see the blog post and Defcon talk go live!!! These are some of my proudest finds 😊
Ever wondered how Windows decides if a file path is local, intranet, or Internet, and why it matters for security? Our latest blog from MSRC Senior Security Research Managers George Hughey (@ecthr0s) and Rohit Mothe (@rohitwas) dives deep into MapUrlToZone (MUTZ), the critical Windows component that helps protect users from credential leaks and remote code execution.
In this blog, you’ll learn:
➤ How MUTZ works behind the scenes
➤ Real-world vulnerabilities and CVEs discovered by Microsoft researchers
➤ The latest fixes and what they mean for Windows security
Check out our latest blog post and see how MSRC is strengthening defenses for everyone: msft.it/6013tD0lW
ALT A deep dive into MUTZ
George Hughey retweeted
At @defcon 33, George Hughey (@ecthr0s) and Rohit Mothe (@rohitwas), Senior Security Research Managers at MSRC, took us back to the 90s with their talk on the ghost of Internet Explorer in Windows: MapUrlToZone.
They uncovered how this legacy API, used by Outlook, Office, Windows Shell, and sandboxes to make security decisions, was vulnerable to manipulation. Their deep dive revealed a dozen CVEs and led to systemic mitigations across Microsoft platforms.
Learn how MSRC’s technical investigations drive proactive protection for customers and why legacy code still matters in the slides available here: msft.it/6013su8Ef
#DEFCON #DEFCON33
ALT George Hughey and Rohit Mothe
This week's Patch Tuesday included 8 CVEs that @rohitwas and I found!
We've been focusing on findings ways to bypass MapUrlToZone and found several very interesting ways to confuse it. This is an API we've seen a lot of interest in lately, so good to have it locked down!
As many of these exploit differences in CreateFile and MUTZ, we've duplicated some of the behavior in CreateFile. This should help prevent similar bypasses in the future. We're planning on releasing more info about this research over the coming months, so stay tuned!
George Hughey retweeted
To help protect against NTLM relay attacks, we’ve enabled Extended Protection for Authentication (EPA) by default in Windows Server 2025. This update strengthens key services like Exchange Server, Active Directory Certificate Services (AD CS), and LDAP, making identity compromise and unauthorized access more difficult.
Learn more about these security improvements and how they can help protect your systems in our blog post: msrc.microsoft.com/blog/2024…
My 50th CVE came out in today's Patch Tuesday! CVE-2024-38240 is the last of some hardening we've been doing in a Windows service, and CVE-2024-38252/CVE-2024-38253 are two proactive efforts we worked on with some static analysis friends :)
George Hughey retweeted
CanSecWest Presentation:
Rolling in the Dough: How Microsoft Identified and Remediated a Baker’s Dozen of Security Threats in the Windows DNS Server
George Hughey, Microsoft
secwest.net
ALT CanSecWest 2024 March 20-22 Vancouver
Yesterday's Patch Tuesday saw the release of 10 CVEs I found in DNS! These could potentially allow an authenticated attacker to gain remote code execution. A huge thank you to the DNS team who worked through and fixed these.
msrc.microsoft.com/update-gu…
Forget buffaloes, the longest grammatically correct sentence using one repeating word is "sudo sudo sudo sudo sudo sudo sudo sudo sudo"
Yesterday, a vulnerability in DNS I found was patched: msrc.microsoft.com/update-gu…. Thanks to the DNS team for working through this one!
Tuesday saw the release of fixes for four vulnerabilities I discovered (CVE-2022-26801, CVE-2022-26802, CVE-2022-26803, CVE-2022-24536). Go check them out! msrc.microsoft.com/update-gu…
George Hughey retweeted
It's long been assumed that there are no nontrivial reflected amplification attacks using TCP—prior attacks are UDP or simply TCP SYNs. In our just-now-accepted @USENIXSecurity 2021 paper, we apply a genetic algorithm to discover 5 reflected TCP amplification attacks + variants.