For Storms, that sounded like Microsoft was looking for a technology or technique to mitigate so-called “return-oriented programming,” or ROP vulnerabilities.
ROP is a focus of researchers right now, said Storms, because it can be used by attackers to sidestep current Windows security technologies like ASLR, or address space layout randomization. ASLR is an anti-exploit technology used in Windows to make it more difficult for hackers to predict available blocks of memory that are available to execute their malicious code.
Storms described ROP as piecing together function calls in ways that are not intended, and can be used for some advantage to the attacker in order to load code into memory.
“There’s always going to be some bit of memory that could be useful for ROP,” said Storms. “If Microsoft is able to do away with the ROP method of execution, that’s a big win.”
BlueHat Prize winners will retain the intellectual rights to their invention, but must license it to Microsoft on a royalty-free basis, said Moussouris. Eligible entries must provide a prototype that runs on Windows and be developed using the Windows SDK (software developer kit), according to the contest rules.
A panel of Microsoft employees from the Microsoft Security Response Center (MSRC), the Windows group and Microsoft’s research arm will judge the entries.
“Microsoft knows there will always be bugs in its code, but a defensive technology to add to ASLR and DEP [data execution prevention, another anti-exploit safeguard in Windows] will prevent those bugs from being actionable,” said Storms.
But the contest’s payback could be years down the road.
“I think [the technology] could show up in Windows 9, or maybe in a version of IE, like IE 11 or IE 12,” said Storms. “Windows 8 is already over the hump in their production cycle.”
It’s possible Microsoft would be able to integrate the winning technology in a service pack for Windows 8, which is expected to debut next year, perhaps as early as April or as late as next fall, Storms added.
“It’s one thing for someone to come up with the idea and prototype, it’s another for Microsoft to actually implement it in Windows,” Storms said.
Microsoft hasn’t committed to rerunning the contest next year, but said today that it would evaluate this first run, then determine how or if the competition changes in the future.