|
Microsoft on Thursday identified a Chinese security partner as thesource of a leak last March in its highly restricted vulnerabilityinformation-sharing program. The company, Hangzhou DPTech Technologies, was tossed out of theMicrosoft Active Protection Program (MAPP) for leaking theproof-of-concept exploit. [ Also on InfoWorld: Microsoft plans big May patch slate . Prevent corporate data leaks with Roger Grimes' " Data Loss Prevention Deep Dive " PDF expert guide, only from InfoWorld. Stay up to date on thelatest security developments with InfoWorld's Security Central newsletter. ] "During our investigation into the disclosure of confidential datashared with our Microsoft Active Protections Program (MAPP)partners, we determined that a member ... Hangzhou DPTechTechnologies Co., Ltd., had breached our non-disclosure agreement(NDA)," Yunsun Wee, director of Microsoft's Trustworthy Computinggroup, wrote in a post to a company blog . " Microsoft takes breaches of our NDAs very seriously and has removed thispartner from the MAPP Program." Wee also said that starting with this month's security updates -- slated to ship Tuesday -- Microsoft has "strengthened existing controls and took actionsto better protect our information." He did not elaborate on the steps Microsoft has taken to preventanother leak or explain why the company decided DPTech was thesource of the leak. DPTech is based in Hangzhou, a major city in eastern Chinasouthwest of Shanghai. According to the company's website, itdevelops and sells network security products that include UTM(unified threat management) systems, IPS (intrusion preventionsystems) appliances, application firewalls and vulnerabilityscanning software. Andrew Storms, director of security operations at nCircle Security,was stunned that Microsoft named DPTech. "It's not like [Microsoft] to call out someone," Storms said. "I'mnot surprised they cut the offender out of the program [but] Iwould have expected it happen silently." Microsoft launched its investigation in mid-March after Italian security researcher Luigi Auriemma said code in an exploit circulating on a Chinese website wasidentical to what he had provided HP TippingPoint's bug bounty program to qualify for a reward. Auriemma had uncovered a vulnerability in Windows' Remote DesktopProtocol (RDP) in May 2011, then reported it to TippingPoint. Hiscode was used by the Zero Day Initiative to create a workingexploit as part of the bounty program's bug verification work. ZDIpassed along the exploit and other information about the RDPvulnerability to Microsoft. I am an expert from chinagpstrackers.com, while we provides the quality product, such as China IP Network Cameras , China Vehicle GPS Trackers, Car GPS Trackers,and more.
Related Articles -
China IP Network Cameras, China Vehicle GPS Trackers,
|
