Semmle at Microsoft: Vulnerability hunting
Software - Infrastructure
Microsoft is the world’s leading platform and productivity company. With their products and services being used by billions of people and millions of companies every day, software security is of paramount importance. Security researchers in Microsoft’s security response team use Semmle QL to find variants of critical problems, allowing them to identify and respond to serious code problems and prevent incidents.
When security researchers at Microsoft identify the root cause of a vulnerability that they have identified or has been reported externally, they perform variant analysis to find and investigate any variants of the vulnerability.
This is critical. Failure by Microsoft to find and patch all variants at the same time as the original vulnerability increases the risk of code being exploited in the wild.
Microsoft leverages Semmle QL to perform variant analysis, scaling their variant finding over time and across multiple codebases and securing their software.
Read how security researchers at the Microsoft Security Response Center (MSRC) use Semmle QL in a series of blog posts, written by Steven Hunter, Security Software Engineer at MSRC.