The BlueHat Podcast

• Securing Redirections with Mike Macelletti

  In this episode of The BlueHat Podcast, host Nic Fillingham and Wendy Zenone are joined by Mike Macelletti from Microsoft’s MSRC Vulnerabilities and Mitigations team to explore Redirection Guard, a powerful mitigation designed to tackle a long-standing class of file path redirection vulnerabilities in Windows. Mike shares how his interest in security began, the journey behind developing Redirection Guard, and how it's helping reduce a once-common bug class across Microsoft products. He also explains how the feature works, why it's impactful, and what developers can do to adopt it. Plus, a few fun detours into Solitaire hacking, skiing, and protein powder.     In This Episode You Will Learn:   What Redirection Guard is and how it helps prevent file system vulnerabilities  How Microsoft identifies and addresses common bug classes across their ecosystem  Why some vulnerabilities still slip past Redirection Guard and what’s out of scope    Some Questions We Ask:  What is a junction and how is it different from other redirects?  How does Redirection Guard decide which shortcuts to block?  Are there vulnerabilities Redirection Guard doesn’t cover?      Resources:       View Mike Macelletti on LinkedIn      View Wendy Zenone on LinkedIn    View Nic Fillingham on LinkedIn     Related Microsoft Podcasts:    Microsoft Threat Intelligence Podcast    Afternoon Cyber Tea with Ann Johnson    Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts      The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.

  --------  

  42:02
• Ignore Ram Shankar Siva Kumar’s Previous Directions

  In this episode of The BlueHat Podcast, host Nic Fillingham and Wendy Zenone share Ram Shankar Siva Kumar’s dynamic keynote from BlueHat India 2025, where he explores the evolving threat landscape of AI through the lens of the Microsoft AI Red Team. From adversarial machine learning to psychosocial harms and persuasive AI, Ram highlights real-world case studies, including prompt injection, content safety violations, and memory poisoning in AI agents. Ram underscores the urgent need for robust red teaming practices to secure AI systems against traditional security flaws and emerging threats across images, text, audio, and autonomous agents.    In This Episode You Will Learn:   Why old-school security flaws still break modern AI systems  Real-world AI red teaming in action, from scams to memory hacks  How small input tweaks can fool AI across images, audio, and text  Some Questions We Ask:  Can attackers fool AI using just slight image changes?  Are generative AI systems vulnerable to prompt manipulation?  Do you need to be an expert to break an AI model?      Resources:       Watch Ram’s BlueHat India 2025 Keynote: BlueHat India 2025 Day 2 Keynote - Ram Shankar Siva Kumar  Listen to Ram’s Previous Appearance on The BlueHat Podcast: Not with a Bug but with a Sticker    View Ram Shankar Siva Kumar on LinkedIn     View Wendy Zenone on LinkedIn    View Nic Fillingham on LinkedIn     Related Microsoft Podcasts:    Microsoft Threat Intelligence Podcast    Afternoon Cyber Tea with Ann Johnson    Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts      The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.

  --------  

  39:54
• Protecting AI at the Edge with David Weston

  In this episode of The BlueHat Podcast, host Nic Fillingham and Wendy Zenone share David Weston’s keynote from BlueHat India 2025. David explores the growing role of on-device AI in Windows, the security risks it introduces, and how Microsoft is rethinking architecture to defend against new threats like model tampering, data exfiltration, and AI-powered malware. He also shares insights on innovations like Windows Recall, biometric protection, and the future of secure, agentic operating systems.     In This Episode You Will Learn:   How AI integration in Windows (like Windows Recall and MS Paint) is evolving  Emerging threats from protocols like MCP and CUAs  What a “confused deputy” attack is, and how Microsoft is protecting users  Some Questions We Ask:  What are the biggest security threats in on-device AI—data, model, or runtime?  Can AI be used to accelerate post-compromise attacks?  What will it take to bring Azure-level confidential computing to the consumer device?      Resources:       View David Weston on LinkedIn    View Wendy Zenone on LinkedIn    View Nic Fillingham on LinkedIn        Related Microsoft Podcasts:    Microsoft Threat Intelligence Podcast    Afternoon Cyber Tea with Ann Johnson    Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts    The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.

  --------  

  39:15
• Hacking at the Weeds with Felix Boulet

  In this episode of The BlueHat Podcast, host Nic Fillingham and Wendy Zenone are joined by Felix Boulet fresh off his participation in Zero Day Quest. Felix talks about his unique journey from industrial maintenance to becoming a full-time vulnerability researcher, and how that background fuels his passion for hacking and bug bounty work. He explains his method for finding bugs in Microsoft products—particularly in identity systems—and why identity is such a valuable target for attackers. Felix also shares highlights from the Zero Day Quest event, where he focused on building connections, learning from Microsoft engineers, and experiencing the collaborative side of the security community.     In This Episode You Will Learn:   Why identity-based bugs are especially valuable and dangerous in the security world  When breaking identity controls can be the key to pivoting through an entire system  How SharePoint's concept of "virtual files" impacts vulnerability validation  Some Questions We Ask:  What was your first bug bounty experience?  Can you explain what the flash challenges were and what your experience was like?  Do you think sharing bug ideas could cost you a bounty?      Resources:       View Felix Boulet on LinkedIn   View Wendy Zenone on LinkedIn    View Nic Fillingham on LinkedIn     Related Microsoft Podcasts:    Microsoft Threat Intelligence Podcast    Afternoon Cyber Tea with Ann Johnson    Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts      The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.

  --------  

  33:19
• Evolutions in Hacking with Marco Ivaldi

  In this episode of The BlueHat Podcast, host Nic Fillingham and Wendy Zenone are joined by Marco Ivaldi, co-founder and technical director of HN Security, a boutique company specializing in offensive security services, shares his journey from hacking as a teenager in the '80s to becoming a key figure in the security research community. With nearly three decades of experience in cybersecurity, Marco digs into the ongoing challenges, particularly in Active Directory and password security, highlighting vulnerabilities that continue to pose significant risks today. He recounts his unexpected path into bug bounty hunting, including his involvement in Microsoft's Zero Day Quest and his passion for auditing real-time operating systems like Azure RTOS.  In This Episode You Will Learn:  How Marco taught himself BASIC and assembly through cassette tapes and trips to local libraries Why mentorship and positive leadership can catapult your cybersecurity career When measuring network response times can unintentionally leak valuable info Some Questions We Ask: Do you remember the first time you made code do something unexpected? What was your experience like in the Zero Day Quest building for those three days? How are you thinking of approaching fuzzing after Zero Day Quest?      Resources:      View Marco Ivaldi on LinkedIn    View Wendy Zenone on LinkedIn   View Nic Fillingham on LinkedIn  HN SECURITY Learn More About Marco   Related Microsoft Podcasts:     Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks     Discover and follow other Microsoft podcasts at microsoft.com/podcasts   The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.

  --------  

  49:20

More Technology podcasts

Trending Technology podcasts

About The BlueHat Podcast

The BlueHat Podcast: Podcasts in Family