Microsoft Launches $200,000 Security Innovation Contest

At the Black Hat conference in Las Vegas, Microsoft announced a contest for excellence in defensive security technology. Dubbed "Blue Hat," the contest focuses on "the most effective ways to prevent the use of memory safety vulnerabilities."

Current technologies in this area include Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). Data Execution Prevention blocks attacks that force malicious code into memory areas marked as data. ASLR bollixes malware that needs to find certain code elements at specific addresses. Both Windows and iOS use ASLR.

Katie Moussouris, senior security strategist lead for the Microsoft Security Response Center, said "Microsoft wants to encourage more security experts to think about ways to reduce threats to computing devices. We're looking to collaborate with others to build solutions to tough industry problems." Moussouris believes the Blue Hat Prize will encourage talented researchers to focus on this specific problem area in security.

Brad Arkin, senior director for product security at Adobe, applauded the initiative, saying "This call for entries promises to stimulate research activity within the broader security community on how to mitigate entire classes of attacks rather than thinking about software security as a challenge best addressed one bug at a time." Arkin noted that the research triggered by this challenge "has the potential to lower costs for third-party developers and increase the level of security assurance for end users."

Submissions for the contest will be accepted from August 3 until April 1, 2012. Judges will rate the submissions on practicality (30 percent), robustness (30 percent) and impact (40 percent). The grand prize winner will receive $200,000, and the second place winner $50,000. For the third place winner Microsoft will offer an MSDN Universal Subscription, valued at $10,000. Results will be announced at next year's Black Hat conference. For full details visit www.BlueHatPrize.com.

About Our Expert

Neil J. Rubenking

Principal Writer, Security

My Experience

When the IBM PC was new, I served as the president of the San Francisco PC User Group for three years. That’s how I met PCMag’s editorial team, who brought me on board in 1986. In the years since that fateful meeting, I’ve become PCMag’s expert on security, privacy, and identity protection, putting antivirus tools, security suites, and all kinds of security software through their paces.

Before my current security gig, I supplied PCMag readers with tips and solutions on using popular applications, operating systems, and programming languages in my "User to User" and "Ask Neil" columns, which began in 1990 and ran for almost 20 years. Along the way, I wrote more than 40 utility articles, as well as Delphi Programming for Dummies and six other books covering DOS, Windows, and programming. I also reviewed thousands of products of all kinds, ranging from early Sierra Online adventure games to AOL’s precursor Q-Link.

In the early 2000s, I turned my focus to security and the growing antivirus industry. After years of working with antivirus, I’m known throughout the security industry as an expert on evaluating antivirus tools. I serve as an advisory board member for the Anti-Malware Testing Standards Organization (AMTSO), an international nonprofit group dedicated to coordinating and improving testing of anti-malware solutions.

The Technology I Use

Much of the testing I do, particularly testing with real-world ransomware, is just plain dangerous. To perform such tests safely, I sequester them inside virtual machines managed by VMWare Workstation. For cross-platform testing, I use a MacBook Air, a Google Pixel 4, and a 6th-generation iPad.

I rely on my Delphi coding skills to create and maintain small applications. These include programs to check whether an antivirus correctly handled the malware it detected, launch dangerous URLs and record the security program’s reaction, and analyze the malware that I collect for use in testing. I also wrote a tiny browser and text editor for use in testing security apps that have predefined reactions for known products.

I do my writing and research on a Dell OptiPlex desktop, relying on Microsoft Word (my fingers know all the shortcuts). Many of my articles include charts and analysis; Excel is my go-to for those. When work hours end, though, I escape the bounds of Microsoft and Windows. There’s an iPhone in my pocket, I relax with my oversized iPad, and my Kindle Oasis is always loaded with the best science fiction and fantasy.

Read the latest from Neil J. Rubenking

Read full bio