A vulnerability analyst and prominent member of the infosec industry has blasted Microsoft for refusing to look at a bug report unless he submitted a video alongside a written explanation.

Senior principal vulnerability analyst Will Dormann said last week he contacted Microsoft Security Response Center (MSRC) with a clear description of the bug and supporting screenshots, only to be told that his report wouldn’t be looked at without a video.

MSRC told Dormann: “As requested, please provide clear video POC (proof of concept) on how the said vulnerability is being exploited? We are unable to make any progress without that. It will be highly appreciated.”

Frustrated with Microsoft’s demand, which Dormann said would only show him typing commands that were already depicted in the screenshots, and hitting Enter in CMD, the analyst created a video laden with malicious compliance.

The video is 15 minutes long and at the four-second mark flashes a screenshot from Zoolander, in which the protagonist unveils the “Center for Kids Who Can’t Read Good.”

It also features a punchy techno backing track while wasting the reviewer’s time with approximately 14 minutes of inactivity.

Dormann said via Mastodon: “I get that people doing grunt work have mostly fixed workflows that they go through with common next steps.

“But to request a video that now captures (beyond my already-submitted screenshots) the act of me typing, and the Windows response being painted on the screen adds what of value now?”

To top it all off, when trying to submit the video via Microsoft’s portal, the upload failed due to a 403 error.

Dormann’s complaints coincidentally came on the same day MSRC published a blog highlighting the strengths and key features of its coordinated vulnerability disclosure program.

Requiring a POC video – in addition to screenshots – as part of a vulnerability disclosure isn’t often required in the industry.

CISA uses the Vulnerability Information and Coordination Environment (VINCE), run by Carnegie Mellon, to receive vulnerability reports. It has the option to include a single 10 MB file to support written reports and additional files can be sent directly upon request, where necessary.

Public sector organizations in the UK tend to follow the advice issued by the National Cyber Security Centre (NCSC), which also doesn’t mandate a video report. A short description of the issue and details of how to reproduce the bug are the only requirements. This is generally standard practice, though not universal.

The Register contacted Microsoft for a response. 

We also asked Dormann for additional input. He said requests for video can be found on other platforms such as HackerOne and Bugcrowd but in his opinion, requiring one signals to researchers that the reviewer is merely following a process rather than understanding the report itself.

As the post and video suggest, he was unimpressed by MSRC’s refusal to proceed with the vulnerability report just because a video wasn’t submitted in tandem.

“If a researcher is going out of their way to be nice to vendors and writing up vulnerability reports to share with them, the least the vendor could do is at least pretend to be taking it seriously,” said Dormann. 

“I reported three related but different vulnerabilities to Microsoft recently. Two of them requested video evidence of exploitation (for things that don’t even make sense to have a video of, thus my malicious compliance example that I posted), and the third was rejected as not a vulnerability with clear evidence that the MSRC handler didn’t bother actually reading what I submitted. Researchers doing the ‘right thing’ deserve better.”

Dormann is still waiting to hear back from Microsoft after sending them the video. ®