Vulnerabilities / Threats
7/29/2013
04:34 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Microsoft Extends MAPP To Incident Responders And Offers Free Online URL, File Scanner

Microsoft Active Protections Program evolving to a protection, detection, and remediation program

LAS VEGAS -- BLACK HAT USA 2013 -- In its latest effort to narrow the attack window, Microsoft has fine-tuned and expanded its vulnerability information-sharing program for vendors to include security incident responders.

Click here for more of Dark Reading's Black Hat articles.

In a series of changes announced today to the Microsoft Active Protections Program (MAPP), Microsoft now will provide vendor members intelligence on newly found bugs in Microsoft software sooner -- three business days prior to Patch Tuesday -- to give them more time to prepare and test signatures. To date, MAPP has given them a 24-hour jump on Patch Tuesday. The program also now will offer a validation system, where vendors can assess their detection tools for new Microsoft bugs before they distribute the tools.

And MAPP is no longer for vendors alone: Microsoft is now offering a MAPP program for incident responders as well, where Microsoft will provide them with attack intelligence and an intel-sharing forum to safely share attack particulars, such as malicious URLs, file hashes, and other incident data. CERTs, government entities, and private organizations are the audience here, according to Microsoft. "More incident response companies are spinning up, and CERTs are requiring this information," says Jerry Bryant, senior security strategist for Microsoft's Trustworthy Computing group. "This will facilitate information and response exchange, and start with information we have based on threat indicators ... the biggest goal here is to facilitate the exchange of threat information."

It all boils down to the new reality for organizations today: that attacks from determined threat actors are inevitable, so detection of malware and infiltration are key to recovering and remediating as soon as possible. "This is just the beginning of a lot of changes we're making under MAPP," Bryant says. "Our goal is to move the program from just a protection program to a protection, detection, and remediation program."

Microsoft has been forging closer ties with outside security researchers during the past few years, starting with its Blue Hat Summit, then the Blue Hat Prize in 2011, which awarded researchers with cash and prizes for coming up with defense mitigation methods, and, most recently, its game-changing, three-part bug bounty program launched late last month. The software giant has received 19 submissions for the bug bounty program as of July 17.

[How Microsoft's new bug bounty program will play in the quest for more secure software. See Microsoft's Big Bucks For Bugs Ups The Ante.]

Microsoft also is now offering a free cloud-based MAPP Scanner tool that scans documents, PDFs, and URLs for what it calls "content-based" attacks. The Azure-based cloud service is currently in beta with MAPP vendor and response partners, who submit documents or URLs for scanning, which is processed in a virtual machine. The service is based on an internal tool used by Microsoft to analyze suspicious documents.

"The advantage of the MAPP Scanner is that it focuses on unknown vulnerabilities," Bryant says. "It's based on a tool we use in our content-based investigations. Our intention was to provide it to the response community at no charge."

The scanner service provides "active analysis" to discern whether a file is attempting to exploit a bug, and the goal is to pinpoint new attacks and attack vectors.

"What we're doing with MAPP is part of our overall strategy for protecting customers," Bryant says. "We want to get as many exploits off the street as possible, and then we can work on remediation. The partner programs we have under the MAPP moniker are the vehicle" for this, he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Ashu001
50%
50%
Ashu001,
User Rank: Apprentice
7/30/2013 | 6:36:20 PM
re: Microsoft Extends MAPP To Incident Responders And Offers Free Online URL, File Scanner
Microsoft deserves all the Credit they get here.

Very impressive compared to the Lack of attention that Apple pays to this space;Microsoft continues to win Hearts and Minds here!
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-8626
Published: 2014-11-22
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding...

CVE-2014-8710
Published: 2014-11-22
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.

CVE-2014-8711
Published: 2014-11-22
Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?