March 25th, 2009

Microsoft adds 'Skywing' to Windows defense team

Posted by Ryan Naraine @ 11:57 am

Categories: Arbitrary Code Execution, Complex Attacks, Data theft, Exploit code, Hackers, Hirings and firings, Kernel-level Exploits, Metasploit, Microsoft, Patch Watch, Pen testing, Punditocracy, Research, Responsible disclosure, Viruses and Worms, Vulnerability research, Zero-day attacks

Tags: Team, Microsoft Corp., Defense, Shostack, Microsoft Windows, Operating Systems, Security, Software, Ryan Naraine

Ken ‘Skywing’ Johnson, a well-known hacker famous for his work on bypassing several Windows anti-exploitation mechanisms, has joined the software maker to help make it harder to compromise the operating system.

Johnson, who teamed up with another recent Microsoft hire — Matt ‘Skape’ Miller — on several Uninformed Journal articles on breaking into the Windows OS, will be working on “everything related to vulnerabilities, exploits, defenses [and] bypassing defenses,” according to Microsoft’s Michael Howard.

[ SEE: From Metasploit to Microsoft: Skape goes to Redmond ]

This isn’t Redmond’s first dip into the attack-focused hacker pool for talent.  As Dennis Fisher points out, the recruiting essentially began about three years ago when Adam Shostack joined Microsoft. Shostack is a well-known security and privacy expert and had spent years in start-ups and smaller organizations and was not afraid to be critical of Microsoft’s policies.

Last year, the company also hired Linux security guru Crispin Cowan to fix the UAC mess and snapped up Metasploit developer Matt Miller to work on improved ways to find security vulnerabilities and better software defenses through mitigations.

• Given the emphasis that Microsoft has placed on anti-exploitation and memory protection in its most recent releases, including Vista and Internet Explorer 8, it stands to reason that the company will continue to bring in more of the people who have done work on the other side of that fence. There’s no defense like a good offense.

Here’s a sample of Skywing’s research:

• Bypassing Windows Hardware-enforced Data Execution Prevention
• Subverting PatchGuard Version 2
• Exploiting the Otherwise Non-exploitable on Windows