Cam

Sometimes the biggest discoveries start with a simple question: What happens if I try this? At BlueHat Asia, Vaisha Bernard (@the1bernard), a two-time Microsoft Most Valuable Researcher (MVR) from Eye Security, and Cameron Vincent (@secretlyhidden1), Senior Security Researcher, MSRC shared how a seemingly small test, swapping a GET request for a PUT request, ultimately led to five critical vulnerabilities and a broader effort to help secure Microsoft's ecosystem. The talk discussed how curiosity, persistence, and a deep understanding of cloud infrastructure uncovered a pattern involving Azure Front Door, Azure Blob Storage, and overprivileged managed identities. What began as a single finding evolved into a larger variant hunting effort across Microsoft, helping teams identify and remediate similar issues at scale. A recurring theme throughout the talk was the importance of challenging assumptions. Even when a test seems unlikely to succeed, that one unexpected result can reveal something much larger. The presentation also reinforced a fundamental security principle: apply least privilege wherever possible and avoid granting managed identities more access than they truly need. Key takeaways for researchers: • Follow the breadcrumbs. Small discoveries can uncover much larger security issues. • Look beyond the initial vulnerability. Understanding how systems are architected can reveal additional attack paths and impact. • Pay attention to patterns. Multiple findings can point to broader systemic risks that warrant deeper investigation. • The most impactful research doesn't just find a bug. It helps drive security improvements across an entire ecosystem.

Day 2 is underway at BlueHat. Here’s a look back at Day 1. A strong start, with the security community coming together to connect, share insights, and tackle real-world challenges. Watch the highlights ⬇️ #BlueHat

At BlueHat Asia, Cameron Vincent (@SecretlyHidden1), Senior Security Researcher, Microsoft, and Brian McNulty (@brianjmcnulty), MSRC Summer Intern and University of Michigan graduate student, shared their journey hunting security variants across the Microsoft ecosystem. Highlights from their talk: ➤ Fast impact: Brian, as an intern, discovered 22 critical issues in just 3 months, proving you don’t need years of experience to make a difference. Cam encouraged everyone to start researching and submitting vulnerabilities to Microsoft. ➤ Multi-tenant authorization risks: The team explained how attackers can exploit multi-tenant apps to gain unauthorized access, even impersonating users with any app role, name, or email. ➤ IMPOSTR tool: They introduced IMPOSTR, an automated tool that scans Microsoft’s internal ecosystem for vulnerable multi-tenant applications, helping escalate and fix critical issues quickly. ➤ Real-world discovery: Their first big find? An AI chatbot app that allowed attackers to override prompts and access sensitive internal data, including outage and security incident details. ➤ Copilot & MCP security: The talk highlighted how missing authentication or authorization in Copilot chatbots and Model Context Protocol (MCP) servers can expose internal data and logs. ➤ Best practices: The team emphasized the importance of validating OAuth state parameters, restricting access to whitelisted tenants, and following secure coding practices to keep MCP servers safe. You don’t need to be a veteran to make an impact in security research. With curiosity, the right tools, and a holistic approach, anyone can help safeguard the ecosystem. #BlueHatAsia

We hosted a pre-BlueHat Asia welcome reception this evening, giving our speakers, MSRC MVRs, and Microsoft team members a great opportunity to connect. A huge thank you to our presenters and MVRs for their role in making #BlueHatAsia a success! We can’t wait to kick off BlueHat Asia tomorrow morning. Get ready for an incredible day of learning and collaboration!

We’re excited to announce our next BlueHat Asia speakers: Brian McNulty (@brianjmcnulty) and Cameron Vincent (@SecretlyHidden1)! Cameron is a Senior Security Researcher at Microsoft, specializing in vulnerabilities and mitigation within MSRC. From reproducing bug reports to variant hunting, Cameron has spent the last decade identifying and mitigating trends to protect the Microsoft ecosystem. His research focuses on authentication and authorization vulnerabilities, an area he’s been passionate about for over 10 years. Brian began making a name for himself through Meta’s bug bounty program and is just getting started. Currently a student at the University of Michigan, Brian has proven his skills as a 2025 MSRC intern and as a top player in the bug bounty world, ranking in Meta’s top 5 multiple times. He’s also working toward his master’s in computer science, continuing to push boundaries in security research. Their upcoming talk will take you inside the MSRC Vulnerabilities & Mitigations team, exploring how variant hunting and deep issue analysis help secure the Microsoft ecosystem. #BlueHatAsia