MSRC

Mitigating NTLM Relay Attacks by Default

Monday, December 09, 2024

Introduction In February 2024, we released an update to Exchange Server which contained a security improvement referenced by CVE-2024-21410 that enabled Extended Protection for Authentication (EPA) by default for new and existing installs of Exchange 2019. While we’re currently unaware of any active threat campaigns involving NTLM relaying attacks against Exchange, we have observed threat actors exploiting this vector in the past.

Announcing the Adaptive Prompt Injection Challenge (LLMail-Inject)

Friday, December 06, 2024

We are excited to introduce LLMail-Inject, a new challenge focused on evaluating state-of-the-art prompt injection defenses in a realistic simulated LLM-integrated email client. In this challenge, participants assume the role of an attacker who sends an email to a user. The user then queries the LLMail service with a question (e.

Securing AI and Cloud with the Zero Day Quest

Tuesday, November 19, 2024

Our security teams work around the clock to help protect every person and organization on the planet from security threats. We also know that security is a team sport, and that’s why we also partner with the global security community through our bug bounty programs to proactively identify and mitigate potential issues before our customers are impacted.

• Bounty
• Bug Bounty
• Bug Bounty Programs
• BlueHat
• Artificial intelligence
• Training
• Zero Day Quest
• Secure Future Initiative
• Cloud

Toward greater transparency: Publishing machine-readable CSAF files

Tuesday, November 12, 2024

Welcome to the third installment in our series on transparency at the Microsoft Security Response Center (MSRC). In this ongoing discussion, we talk about our commitment to providing comprehensive vulnerability information to our customers. At MSRC, our mission is to protect our customers, communities, and Microsoft, from current and emerging threats to security and privacy.

• Security Update Guide

Congratulations to the Top MSRC 2024 Q3 Security Researchers!

Wednesday, October 23, 2024

Congratulations to all the researchers recognized in this quarter’s Microsoft Researcher Recognition Program leaderboard! Thank you to everyone for your hard work and continued partnership to secure customers. The top three researchers of the 2024 Q3 Security Researcher Leaderboard are wkai, VictorV, and Zhihua Wen! Check out the full list of researchers recognized this quarter here.

• Bug Bounty
• Bug Bounty Programs
• Bounty
• Community-based Defense
• Security Research
• Security Researcher

Congratulations to the MSRC 2024 Most Valuable Security Researchers!

Tuesday, August 06, 2024

The Microsoft Researcher Recognition Program offers public thanks and recognition to security researchers who help protect our customers through discovering and sharing security vulnerabilities under Coordinated Vulnerability Disclosure. Today, we are excited to recognize this year’s 100 Most Valuable Researchers (MVRs), based on the total number of points earned for each valid report.

• Community-based Defense
• Coordinated Vulnerability Disclosure
• Security Researcher
• Researcher Recognition
• Bug Bounty
• Bug Bounty Programs
• Bounty

Microsoft Bounty Program Year in Review: $16.6M in Rewards 

Monday, August 05, 2024

We are excited to announce that this year the Microsoft Bounty Program has awarded $16.6M in bounty awards to 343 security researchers from 55 countries, securing Microsoft customers in partnership with the Microsoft Security Response Center (MSRC). Each year we identify over a thousand potential security issues together, safeguarding our customers from possible threats through the Microsoft Bounty Program.

• Bounty
• Bug Bounty
• Bug Bounty Programs
• Community-based Defense
• Coordinated Vulnerability Disclosure
• Researcher Recognition
• Security Researcher

Introducing the MSRC Researcher Resource Center

Wednesday, July 31, 2024

Microsoft partners with the global security researcher community to surface and report security vulnerabilities to protect all users of Microsoft products and services. Researcher submissions help us address immediate threats while also identifying trends and insights to holistically improve the security of our products and services. We’re always looking for ways to build upon this partnership, and with that goal in mind, we are excited to announce the creation of the MSRC Researcher Resource Center.

• Security Researcher

Congratulations to the Top MSRC 2024 Q2 Security Researchers!

Wednesday, July 24, 2024

Congratulations to all the researchers recognized in this quarter’s Microsoft Researcher Recognition Program leaderboard! Thank you to everyone for your hard work and continued partnership to secure customers. The top three researchers of the 2024 Q2 Security Researcher Leaderboard are Yuki Chen, Lewis Lee & Ver & Zhiniang Peng, and Wei!

• Bounty
• Bug Bounty Programs
• Bug Bounty
• Community-based Defense
• Coordinated Vulnerability Disclosure
• Researcher Recognition
• Security Researcher

Announcing the CVRF API 3.0 upgrade

Thursday, July 11, 2024

At the Microsoft Security Response Center, we are committed to continuously improving the security and performance of our services to meet the evolving needs of our customers. We are excited to announce the rollout of the latest version of our Common Vulnerability Reporting (CVRF) API. This update brings improvements in both security and performance, without requiring any changes to your existing invocation methods.