Breaking software. Security Researcher @ Microsoft. Views are my own.
United Kingdom
Joined October 2021
- Tweets121
- Following213
- Followers557
- Likes349
Pinned Tweet
A video of the talk I gave at BlackHat Europe ‘Exploring a New Class of Kernel Exploit Primitive’ has been posted here: youtu.be/uqWiZXMh8TI
Black Hat Europe 2022 Briefings and Keynotes are now LIVE on the #BlackHat Youtube Channel!
View all #cybersecurity videos here - bit.ly/3lYgoVO
Andrew Ruddick retweeted
This is a good resource on how to use github.com/0vercl0k/wtf to find bugs in Microsoft's Defender Malware Protection Engine 🔥:
labs.infoguard.ch/posts/atta… by Manuel Feifel
Andrew Ruddick retweeted
Very proud to announce that the Windows Subsystem for Linux is now open source!
blogs.windows.com/windowsdev…
A pre-auth remote DoS in the Windows kernel SMB stack I found was patched today under CVE-2024-43642: msrc.microsoft.com/update-gu…
Had my first serious play with a fuzzer. 9 CVEs went out today for issues I found with that in SQL Server’s Native Scoring feature. Those include arbitrary pointer execution, UAF and OOB memory accesses. msrc.microsoft.com/update-gu…
Andrew Ruddick retweeted
Microsoft identified a North Korean threat actor exploiting a zero-day vulnerability in Chromium (CVE-2024-7971) to gain remote code execution. Our assessment of ongoing analysis and observed infrastructure attributes this activity to Citrine Sleet. msft.it/6010l7S6w
Andrew Ruddick retweeted
Quantum computers could imperil the security of confidential electronic information, such as emails. To counter this threat, NIST has finalized its set of three encryption algorithms designed to withstand a future quantum computer’s cyberattacks: nist.gov/news-events/news/20…
ALT Collage illustration of servers, laptops and phones is divided into left "Old Encryption Standards" and right "New Encryption Standards."
Andrew Ruddick retweeted
MORSE is growing. I'm building a team in the UK which will focus on Windows VR. Hiring lead and IC roles. Can be 100% remote in the UK or go into the office if you want.
jobs.careers.microsoft.com/g…
jobs.careers.microsoft.com/g…
jobs.careers.microsoft.com/g…
Andrew Ruddick retweeted
Excited to share my latest article: PgC - a novel approach to disable Patchguard during runtime using basic memory management principles.
It has worked against every version of Patchguard for the last 7 years, without needing any updates!
blog.can.ac/2024/06/28/pgc-g…
We just prioritised Security above all else, including new feature development. This is an awesome chance to help us make real security improvements from the inside (hint: we’re still hiring). 😉
We’re putting security above all else at Microsoft by expanding the Secure Future Initiative—our commitment to delivering solutions that meet the highest possible security standards. Learn more: msft.it/6017YRK9U #SecureByDesign #CloudSecurity
We’re hiring in the UK. If you have skills and want to hack cool stuff, come join us: jobs.careers.microsoft.com/g…
Andrew Ruddick retweeted
🔺New on the Apple Security Research blog: introducing PQ3, a groundbreaking post-quantum cryptographic protocol for iMessage. To our knowledge, PQ3 has the strongest security properties of any at-scale messaging protocol in the world. security.apple.com/blog/imes…
Andrew Ruddick retweeted
Windows Kernel Team is hiring:
lnkd.in/d_Qxfdvw
lnkd.in/dqGN-ViC
lnkd.in/dnKt7xrv
lnkd.in/gajwYgjw
Come and join the OS group! :-)
Andrew Ruddick retweeted
Write up of the HVCI bypass vuln (CVE-2024-21305) with @aall86 !
tandasat.github.io/blog/2024…
Andrew Ruddick retweeted
learn.microsoft.com/en-us/wi… This is a great article, even for non super-technical audience :-) Happy New Year folks!
Andrew Ruddick retweeted
We have something coming for CLFS. I hope to share details early in 2024.
Maybe the Microsoft security folks that are pushing rustlang support for drivers should consider CLFS is an old pile of unsafe code that is getting repeatedly abused by threat actors. Consensus among RE friends says it needs a rewrite. @epakskape @dwizzzleMSFT @markrussinovich
Andrew Ruddick retweeted
New blog is out detailing some changes we're making to the print system in Windows. TLDR its more secure and no more drivers. This will eventually become the default for Windows once we work out the user experience.
techcommunity.microsoft.com/…
Andrew Ruddick retweeted
New DisallowFsctlSystemCalls in 24H2 allows blocking a process that shouldn't be making FSCTLs.
Faults will generate an event in Microsoft-Windows-Security-Mitigations/Kernel Mode channel.
Currently only enabled in msedge.exe (mostly in audit mode).
Andrew Ruddick retweeted
I got time to update a draft that should've been published long ago. Here is a fun PG-compliant hooking mechanism, and the example covered in the article is system-wide SYSCALL hooks in a PG-compliant manner.
revers.engineering/fun-with-…
Andrew Ruddick retweeted
Exciting news! 📣 We’re launching the Microsoft Defender Bounty Program, offering awards up to $20,000 for identifying vulnerabilities in our Defender products and services. Learn more in our blog post: msft.it/6016iHEtq #bugbounty
A Hyper-V Info Disclosure I found was patched today: msrc.microsoft.com/update-gu…
Security updates for November 2023 are now available! Details are here: msft.it/60119yPTS
#PatchTuesday #SecurityUpdateGuide
ALT Security updates for November 2023 are now available