The entries were judged on functionality, robustness, and impact, by a panel of Microsoft security engineers. "We can't wait to see how this how [BlueHat] will inspire others to explore defensive technology research", said Mike Reavey, senior director, Microsoft Security Response Center.
The three finalists are:
- Jared DeMott (Entry: /ROP: Checks the safety of target addresses of return instructions, which ROP exploits use)
- Ivan Fratric (Entry: ROPGuard: Defines a set of checks that can be used to detect when certain functions are being called in the context of malicious ROP code)
- Vasilis Pappas. (Entry: kBouncer: An ROP mitigation technique that detects abnormal control transfers using common hardware features)
Each finalist developed a solution that obstructs attacks that use return-oriented programming (ROP).
The second prize is $50,000 and third prize is an MSDN Universal subscription valued at $10,000. Microsoft is to announce the winner at the company's researcher appreciation party on 26 July after BlackHat 2012 in Las Vegas.
Winners will retain IP ownership of their work and will grant Microsoft a licence to use it in its products.