A year ago at Black Hat security conference, Microsoft announced the BlueHat Prize. Today it released EMET 3.5 (Enhanced Mitigation Experience Toolkit) technology preview which incorporated one of the BlueHat Prize finalist's defensive technologies. Las Vegas – It has only been a few months since the close of the BlueHat Prize entry period and today Microsoft announced that it has already incorporated one of the BlueHat Prize finalist’s defensive technologies. It’s designed to mitigate attacks that leverage Return Oriented Programming (ROP), into its latest Enhanced Mitigation Experience Toolkit (EMET) 3.5 Technology Preview. EMET is a tool that systems administrators can use to help mitigate vulnerabilities and detect exploitation attempts, further protecting customers.According to MSRC, “We often talk about exploit economics – the idea that increasing the difficulty of attack makes it more expensive (in terms of time and effort) and begins discouraging exploitation. EMET 3.5 is a great example of exploit economics in action as it offers protection for entire classes of vulnerabilities. EMET also provides defenses that protect assets from unknown threats.”A year ago this week during the Black Hat security conference, Microsoft announced the BlueHat Prize and challenged the security community to think outside the box and focus on defensive innovation. The three finalists are Jared DeMott, Ivan Fratric and Vasilis Pappas. The grand prize is $200,000, the second prize is $50,000, and the third prize is an MSDN subscription valued at $10,000. On Thursday, July 26, 2012, Microsoft will announce the BlueHat Prize grand prize winner at its Black Hat Researcher Appreciation Party. I’ll be there to take a few pictures and give you a summary of finalists’ entries.All three of the BlueHat finalists submitted prototype mitigations that help prevent exploits that use Return Oriented Programming (ROP) techniques. The Microsoft Security Response Center announced that the “new Tech Preview of EMET offers four new checks based on Ivan Fratric’s ROP exploit mitigation to help prevent attacks utilizing ROP techniques.” This quick turnaround, “the fact that the BlueHat Prize has gone from contest announcement to real protection for customers within a single calendar year shows the positive impact of collaboration with the security community.” Microsoft has also released its annual Microsoft Security Response Center Progress Report [PDF]. The report “provides overviews, statistics and a behind-the-scenes look into the work of the MSRC team throughout the past year.” Some of the highlights include:The impact of including one of the BlueHat Prize finalist’s technologies into the EMET 3.5 Technology PreviewA rare behind-the-scenes look into the process of releasing an out-of-band security bulletin.An overview of Coordinated Vulnerability Disclosure (CVD), the future of vulnerability reporting and tracking that helps organizations to automate vulnerability content intake and prioritization.A look into how the company investigates third-party vulnerabilities and coordinates the release of security updates through Microsoft Vulnerability Research (MSVR).Statistics about Microsoft Security Bulletins, including a breakdown of the bulletins issued and Common Vulnerabilities and Exposures addressed since 2006.An overview of the Microsoft Active Protections Program (MAPP), including testimonials from MAPP partners.Data from the Microsoft Exploitability Index, including an overview of the index and breakdown of the ratings numbers since the launch of the Index in October 2008.Meanwhile, life at the Rio in Las Vegas is heating up with “strange” warning alerts over the intercom, dining room lights and casino TVs “randomly” flashing off and on. It’s not ghosts in Vegas; the hackers are here for Def Con bringing fun and good times! Like this? Here’s more posts:EFF: Americans may not realize it, but many are in a face recognition database nowHOPE 9: Whistleblower Binney says the NSA has dossiers on nearly every US citizenNSA Whistleblower Drake: You’re automatically suspicious until proven otherwiseMobile Phone Surveillance Out of Control: Cops Collected 1.3 Million Customer RecordsHigh tech car theft: 3 minutes to steal keyless BMWsTSA lawlessly snubs federal court ruling for 1 year! Interview with Jim HarperGov’t surveillance ‘unreasonable’ & violated the 4th amendment ‘at least once’Domestic drones: security and privacy game changerNSA claims it would violate Americans’ privacy to say how many of us it spied onIndependence Day: Ghosts of SCOTUS on the fundamental right to privacyWindows 8 technology shift: The coming end of Win32 appsGoing Dark in the Golden Age of Cyber-Surveillance?Exploiting Windows: Upcoming Black Hat Briefings Follow me on Twitter @PrivacyFanatic Related content news Dow Jones watchlist of high-risk businesses, people found on unsecured database A Dow Jones watchlist of 2.4 million at-risk businesses, politicians, and individuals was left unprotected on public cloud server. By Ms. Smith Feb 28, 2019 4 mins Data Breach Hacking Security news Ransomware attacks hit Florida ISP, Australian cardiology group Ransomware attacks might be on the decline, but that doesn't mean we don't have new victims. A Florida ISP and an Australian cardiology group were hit recently. By Ms. Smith Feb 27, 2019 4 mins Ransomware Security news Bare-metal cloud servers vulnerable to Cloudborne flaw Researchers warn that firmware backdoors planted on bare-metal cloud servers could later be exploited to brick a different customer’s server, to steal their data, or for ransomware attacks. By Ms. Smith Feb 26, 2019 3 mins Cloud Computing Security news Meet the man-in-the-room attack: Hackers can invisibly eavesdrop on Bigscreen VR users Flaws in Bigscreen could allow 'invisible Peeping Tom' hackers to eavesdrop on Bigscreen VR users, to discreetly deliver malware payloads, to completely control victims' computers and even to start a worm infection spreading through VR By Ms. Smith Feb 21, 2019 4 mins Hacking Vulnerabilities Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe