[ISN] Microsoft goes public with Blue Hat hacker conference

[InfoSec News]

http://www.computerworld.com/securitytopics/security/story/0,10801,109606,00.html

By Robert McMillan
MARCH 16, 2006
IDG NEWS SERVICE

Microsoft Corp. is going public with some of the hacking information
discussed at its Blue Hat Security Briefings event. Just days after
the end of its third Blue Hat conference, the software vendor today
posted the first blog entries at a new Web site. Microsoft is also
promising to publish more details on the secretive invitation-only
event.

The Web site will include Microsoft staffer's "reflections on BlueHat
3" as well as photos, podcasts and video interviews with some of the
presenters, said Security Program Manager Kymberlee Price in a blog
posting. "We sincerely hope that our BlueHat 3 speakers (and BlueHat 1
& 2 speakers) will post their comments to the site as well and share
their BlueHat experience," she wrote.

Presentations given during the latest conference, held last week on
Microsoft's campus in Redmond, Wash., covered topics such as
"exploiting Web applications" and "breaking into database systems,"  
according to the Web site.

Microsoft started the Blue Hat briefings a year ago to begin a
dialogue between the company's security team and external security
researchers, many of whom have been critical of the company's approach
to security. A handful of outside security researchers spent a few
days at Blue Hat discussing Microsoft's security vulnerabilities with
several hundred of the company's engineers and executives.

There were more than 650 attendees at Blue Hat 3, which was also
broadcast to Microsoft employees worldwide, according to Alexander
Kornbrust, a business director at Red-Database-Security GmbH in
Neunkirchen, Germany, who attended the event.

One Microsoft blogger praised the open dialogue at the event.

"Everything was fair game," wrote SQL Server engineer Brad Sarsfield
in a blog posting. "Hearing senior executives say things like, 'I want
the people responsible for those features in my office early next
week; I want to get to the bottom of this' was at least one measure of
success from my point of view for the event."

The Blue Hat name is a play on the Black Hat conferences, which have
occasionally been criticized by IT vendors. The "blue" part comes from
the color of badges that Microsoft staffers wear on campus.

Last year, Black Hat organizers were sued by Cisco Systems Inc. after
a conference presenter disclosed vulnerabilities in the company's
Internetworking Operating System router software. That lawsuit was
eventually settled with Black Hat agreeing not to further disseminate
the presentation.

Microsoft's site will not have the kind of controversial material that
has popped up at Black Hat. "All researchers at the BlueHat are
responsible," Kornbrust said.