Vulnerabilities / Threats
7/29/2013
04:34 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Microsoft Extends MAPP To Incident Responders And Offers Free Online URL, File Scanner

Microsoft Active Protections Program evolving to a protection, detection, and remediation program

LAS VEGAS -- BLACK HAT USA 2013 -- In its latest effort to narrow the attack window, Microsoft has fine-tuned and expanded its vulnerability information-sharing program for vendors to include security incident responders.

Click here for more of Dark Reading's Black Hat articles.

In a series of changes announced today to the Microsoft Active Protections Program (MAPP), Microsoft now will provide vendor members intelligence on newly found bugs in Microsoft software sooner -- three business days prior to Patch Tuesday -- to give them more time to prepare and test signatures. To date, MAPP has given them a 24-hour jump on Patch Tuesday. The program also now will offer a validation system, where vendors can assess their detection tools for new Microsoft bugs before they distribute the tools.

And MAPP is no longer for vendors alone: Microsoft is now offering a MAPP program for incident responders as well, where Microsoft will provide them with attack intelligence and an intel-sharing forum to safely share attack particulars, such as malicious URLs, file hashes, and other incident data. CERTs, government entities, and private organizations are the audience here, according to Microsoft. "More incident response companies are spinning up, and CERTs are requiring this information," says Jerry Bryant, senior security strategist for Microsoft's Trustworthy Computing group. "This will facilitate information and response exchange, and start with information we have based on threat indicators ... the biggest goal here is to facilitate the exchange of threat information."

It all boils down to the new reality for organizations today: that attacks from determined threat actors are inevitable, so detection of malware and infiltration are key to recovering and remediating as soon as possible. "This is just the beginning of a lot of changes we're making under MAPP," Bryant says. "Our goal is to move the program from just a protection program to a protection, detection, and remediation program."

Microsoft has been forging closer ties with outside security researchers during the past few years, starting with its Blue Hat Summit, then the Blue Hat Prize in 2011, which awarded researchers with cash and prizes for coming up with defense mitigation methods, and, most recently, its game-changing, three-part bug bounty program launched late last month. The software giant has received 19 submissions for the bug bounty program as of July 17.

[How Microsoft's new bug bounty program will play in the quest for more secure software. See Microsoft's Big Bucks For Bugs Ups The Ante.]

Microsoft also is now offering a free cloud-based MAPP Scanner tool that scans documents, PDFs, and URLs for what it calls "content-based" attacks. The Azure-based cloud service is currently in beta with MAPP vendor and response partners, who submit documents or URLs for scanning, which is processed in a virtual machine. The service is based on an internal tool used by Microsoft to analyze suspicious documents.

"The advantage of the MAPP Scanner is that it focuses on unknown vulnerabilities," Bryant says. "It's based on a tool we use in our content-based investigations. Our intention was to provide it to the response community at no charge."

The scanner service provides "active analysis" to discern whether a file is attempting to exploit a bug, and the goal is to pinpoint new attacks and attack vectors.

"What we're doing with MAPP is part of our overall strategy for protecting customers," Bryant says. "We want to get as many exploits off the street as possible, and then we can work on remediation. The partner programs we have under the MAPP moniker are the vehicle" for this, he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Ashu001
50%
50%
Ashu001,
User Rank: Apprentice
7/30/2013 | 6:36:20 PM
re: Microsoft Extends MAPP To Incident Responders And Offers Free Online URL, File Scanner
Microsoft deserves all the Credit they get here.

Very impressive compared to the Lack of attention that Apple pays to this space;Microsoft continues to win Hearts and Minds here!
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-6651
Published: 2014-07-31
Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary files via a .. (dot dot) in the path parameter to (1) add_headers.php or (2) minify.php.

CVE-2014-2970
Published: 2014-07-31
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-5139. Reason: This candidate is a duplicate of CVE-2014-5139, and has also been used to refer to an unrelated topic that is currently outside the scope of CVE. This unrelated topic is a LibreSSL code change adding functionality ...

CVE-2014-3488
Published: 2014-07-31
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

CVE-2014-3554
Published: 2014-07-31
Buffer overflow in the ndp_msg_opt_dnssl_domain function in libndp allows remote routers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS Search List (DNSSL) in an IPv6 router advertisement.

CVE-2014-5171
Published: 2014-07-31
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.

Best of the Web
Dark Reading Radio