Archive

Archive for the ‘Security Research & Defense’ Category

Solving Uninitialized Stack Memory on Windows

May 13th, 2020 No comments

This blog post outlines the work that Microsoft is doing to eliminate uninitialized stack memory vulnerabilities from Windows and why we’re on this path. This blog post will be broken down into a few parts that folks can jump to: Uninitialized Memory Background Potential Solutions to Uninitialized Memory Vulnerabilities InitAll – Automatic Initialization Interesting Findings …

Solving Uninitialized Stack Memory on Windows Read More »

The post Solving Uninitialized Stack Memory on Windows appeared first on Microsoft Security Response Center.

The Safety Boat: Kubernetes and Rust

April 29th, 2020 No comments

Our team, DeisLabs, recently released a new piece of software called Krustlet, which is a tool for running WebAssembly modules on the popular, open-source container management tool called Kubernetes. Kubernetes is used quite extensively to run cloud software across many vendors and companies and is primarily written in the Go programming language. While there have …

The Safety Boat: Kubernetes and Rust Read More »

The post The Safety Boat: Kubernetes and Rust appeared first on Microsoft Security Response Center.

Using Rust in Windows

November 7th, 2019 No comments

This Saturday 9th of November, there will be a keynote from Microsoft engineers Ryan Levick and Sebastian Fernandez at RustFest Barcelona. They will be talking about why Microsoft is exploring Rust adoption, some of the challenges we’ve faced in this process, and the future of Rust adoption in Microsoft. If you want to talk with …

Using Rust in Windows Read More »

The post Using Rust in Windows appeared first on Microsoft Security Response Center.

Vulnerability hunting with Semmle QL: DOM XSS

November 6th, 2019 No comments

In two previous blog posts ( part 1 and part 2), we talked about using Semmle QL in C and C++ codebases to find vulnerabilities such as integer overflow, path traversal, and those leading to memory corruption. In this post, we will explore applying Semmle QL to web security by hunting for one of­­­ the …

Vulnerability hunting with Semmle QL: DOM XSS Read More »

The post Vulnerability hunting with Semmle QL: DOM XSS appeared first on Microsoft Security Response Center.

An intern’s experience with Rust

October 16th, 2019 No comments

Over the course of my internship at the Microsoft Security Response Center (MSRC), I worked on the safe systems programming languages (SSPL) team to promote safer languages for systems programming where runtime overhead is important, as outlined in this blog. My job was to port a security critical network processing agent into Rust to eliminate …

An intern’s experience with Rust Read More »

The post An intern’s experience with Rust appeared first on Microsoft Security Response Center.

Designing a COM library for Rust

October 8th, 2019 No comments

I interned with Microsoft as a Software Engineering Intern in the MSRC UK team in Cheltenham this past summer. I worked in the Safe Systems Programming Language (SSPL) group, which explores safe programming languages as a proactive measure against memory-safety related vulnerabilities. This blog post describes the project that I have been working on under …

Designing a COM library for Rust Read More »

The post Designing a COM library for Rust appeared first on Microsoft Security Response Center.

Building the Azure IoT Edge Security Daemon in Rust

September 30th, 2019 No comments

Azure IoT Edge is an open source, cross platform software project from the Azure IoT team at Microsoft that seeks to solve the problem of managing distribution of compute to the edge of your on-premise network from the cloud. This post explains some of the rationale behind our choice of Rust as the implementation programming …

Building the Azure IoT Edge Security Daemon in Rust Read More »

The post Building the Azure IoT Edge Security Daemon in Rust appeared first on Microsoft Security Response Center.