Vulnerabilities / Threats
7/29/2013
04:34 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Microsoft Extends MAPP To Incident Responders And Offers Free Online URL, File Scanner

Microsoft Active Protections Program evolving to a protection, detection, and remediation program

LAS VEGAS -- BLACK HAT USA 2013 -- In its latest effort to narrow the attack window, Microsoft has fine-tuned and expanded its vulnerability information-sharing program for vendors to include security incident responders.

Click here for more of Dark Reading's Black Hat articles.

In a series of changes announced today to the Microsoft Active Protections Program (MAPP), Microsoft now will provide vendor members intelligence on newly found bugs in Microsoft software sooner -- three business days prior to Patch Tuesday -- to give them more time to prepare and test signatures. To date, MAPP has given them a 24-hour jump on Patch Tuesday. The program also now will offer a validation system, where vendors can assess their detection tools for new Microsoft bugs before they distribute the tools.

And MAPP is no longer for vendors alone: Microsoft is now offering a MAPP program for incident responders as well, where Microsoft will provide them with attack intelligence and an intel-sharing forum to safely share attack particulars, such as malicious URLs, file hashes, and other incident data. CERTs, government entities, and private organizations are the audience here, according to Microsoft. "More incident response companies are spinning up, and CERTs are requiring this information," says Jerry Bryant, senior security strategist for Microsoft's Trustworthy Computing group. "This will facilitate information and response exchange, and start with information we have based on threat indicators ... the biggest goal here is to facilitate the exchange of threat information."

It all boils down to the new reality for organizations today: that attacks from determined threat actors are inevitable, so detection of malware and infiltration are key to recovering and remediating as soon as possible. "This is just the beginning of a lot of changes we're making under MAPP," Bryant says. "Our goal is to move the program from just a protection program to a protection, detection, and remediation program."

Microsoft has been forging closer ties with outside security researchers during the past few years, starting with its Blue Hat Summit, then the Blue Hat Prize in 2011, which awarded researchers with cash and prizes for coming up with defense mitigation methods, and, most recently, its game-changing, three-part bug bounty program launched late last month. The software giant has received 19 submissions for the bug bounty program as of July 17.

[How Microsoft's new bug bounty program will play in the quest for more secure software. See Microsoft's Big Bucks For Bugs Ups The Ante.]

Microsoft also is now offering a free cloud-based MAPP Scanner tool that scans documents, PDFs, and URLs for what it calls "content-based" attacks. The Azure-based cloud service is currently in beta with MAPP vendor and response partners, who submit documents or URLs for scanning, which is processed in a virtual machine. The service is based on an internal tool used by Microsoft to analyze suspicious documents.

"The advantage of the MAPP Scanner is that it focuses on unknown vulnerabilities," Bryant says. "It's based on a tool we use in our content-based investigations. Our intention was to provide it to the response community at no charge."

The scanner service provides "active analysis" to discern whether a file is attempting to exploit a bug, and the goal is to pinpoint new attacks and attack vectors.

"What we're doing with MAPP is part of our overall strategy for protecting customers," Bryant says. "We want to get as many exploits off the street as possible, and then we can work on remediation. The partner programs we have under the MAPP moniker are the vehicle" for this, he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Ashu001
50%
50%
Ashu001,
User Rank: Apprentice
7/30/2013 | 6:36:20 PM
re: Microsoft Extends MAPP To Incident Responders And Offers Free Online URL, File Scanner
Microsoft deserves all the Credit they get here.

Very impressive compared to the Lack of attention that Apple pays to this space;Microsoft continues to win Hearts and Minds here!
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.