Under The Kimono Of Office Security Engineering

No ratings

Presented at CanSecWest 2010 by

Tom and David from the Microsoft Office team presented that large and coordinated effort Microsoft is making to improve the security of Microsoft Office 2010. As was proven by Peter Vreugdenhil, DEP is not fool-proof, and this is why the work that Tom and David do is so important. They discussed a distributed, programmable fuzzer they wrote to discover bugs in Office. Office must process more than 300 different filetypes, and during their investigations they found and fixed more than 1800 bugs in Office 2010 alone. Their work has resulted in the development of the new Gatekeeper and FileBlock technologies to protect Office users from potentially malicious files. To recruit machines for their "fuzzer botnet" they made sure to enlist managers at Microsoft who often have the coolest, fastest gear and use it the least .