Submit high quality critical and important vulnerabilities in Windows Windows Server 2012 Windows Server 2012 R2įocus area Microsoft Edge WIP slow $500 to $15,000  This continues our effort in finding bugs in various stages of developmentĬategory Targets Windows Version Payout range (USD)  Hyper-V escapes, Information disclosure and DOS bugs in Hyper-V  Critical and important vulnerabilities in Windows Insider Preview slow New Microsoft Bounty Programs | Additions Windows Bounty Program includes all critical and important bugs in: Integration to improve container density and scaleĮxtend WDAG technology to contain arbitrary appsįollow us on the MSRC Blogs to get information on new bounties Windows is investing and performance and OS Separate identity and resource infrastructureĭifficult experience for non-technical users Strong kernel isolation for applications running

Kernel attacks are the top path for sandbox escape Kernel limiting effectiveness of filtering Most applications have legacy dependency on Windows not well suited to software kernel Kernel attack surface (~2000 system calls) User-mode sandbox isolation leaves a large Windows kernel is a “target rich” environment Ubiquitous user-mode sandboxing has driven Locked down process No symbolic links, reduced attack surface, and various mitigations on by default

Security boundary Microsoft will address vulnerabilities that can violate AC security boundaryĬapability-based resource access Network, file, registry, and device access are restricted (both read and write) Limit the window of opportunity to exploit BlueHat v17 || Securing Windows Defender Application GuardĮliminate entire classes of vulnerabilities

Microsoft edge app container