Chinese firm leaked RDP exploit code

Powered by SC Magazine
 

Vulnerability sharing programs called into question.

A Chinese security firm was named responsible for the leak of Remote Desktop Protocol (RDP) exploit code and has been booted from Microsoft's vulnerability-sharing program.

Hangzhou DPTech Technologies Co, a specialist in firewalls and intrusion prevention systems, breached its non-disclosure contract with the Microsoft Active Protections Program (MAPP) by leaking the dangerous code.

Complete RDP vulnerability coverage


Under MAPP, Microsoft shares vulnerability details with approved software security providers prior to its monthly fixes being released to allow security firms to immediately protect their customers once the patches are delivered.

Specifically MAPP provides its partners with a comprehensive explanation of the vulnerability, a blueprint to trigger the flaw, information on how to detect the bug and a proof-of-concept file.

The vulnerability in question, a "wormable" weakness in the Windows RDP, was discovered in May 2011 by researcher Luigi Auriemma, who reported his find to TippingPoint's Zero Day Initiative (ZDI) bug bounty service.

It was handed in August to Microsoft to develop a fix.

In March, Microsoft released a patch that came with a warning that the software giant expected to see a code-execution exploit released within 30 days.

It took about two days for a proof-of concept (PoC) to appear on a Chinese hacker site. No known remote exploit has been released.

Upon investigation, Auriemma discovered many similarities between the published PoC and the one that he sent ZDI so the service could test the vulnerability.

As further proof, the posted code appeared modelled after the PoC that Microsoft developed in November for internal tests, and which, he concluded, was likely distributed to partners as part of the MAPP.

"[The PoC published on the Chinese site] contains some debugging strings like 'MSRC11678' which is a clear reference to the Microsoft Security Response Center," Auriemma said.

Based on the evidence, Auriemma determined that those responsible for creating the publicly available PoC were the beneficiaries of a leak.

As it turned out, he was right. Now, Microsoft plans to tighten the security controls around the MAPP, though it wouldn't elaborate.

MAPP  team manager Maarten Van Horenbeeck said Microsoft took careful steps to ensure incidents like this rarely occurred.

"We recognise that there is the potential for vulnerability information to be misused," he said.

"In order to limit this as much as possible, we have strong non-disclosure agreements (NDA) with our partners. Microsoft takes breaches of its  NDAs very seriously. In addition, we make sure to only release data shortly in advance of the security update.

"Today, we send MAPP data to our partners just as far in advance as they need to get that work done."

A Microsoft spokeswoman could not immediately be reached for comment. An email sent to DPTech for comment was not immediately returned.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


Chinese firm leaked RDP exploit code
 
 
 
Top Stories
Myer CIO named retailer's new chief executive
Richard Umbers to lead data-driven retail strategy.
 
Empty terminals and mountains of data
Qantas CIO Luc Hennekens says no-one is safe from digital disruption.
 
BoQ takes $10m hit on Salesforce CRM
Regulatory hurdles end cloud pilot.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Microsoft is offering Azure for Disaster Recovery to Australian SMBs
Feb 10, 2015
If you haven't talked to your IT provider about disaster recovery, it might be worth discussing ...
The 2015 Xero Roadshow is on: here are the locations and dates
Feb 6, 2015
The 2015 Xero Roadshow kicked off this week - see where you can attend at locations around ...
Microsoft Outlook is now on iPhone and iPad: why could this be useful?
Jan 30, 2015
Microsoft today released Office for Android and Outlook for iOS - complementing the other Office ...
Franchisees, here's something you should know about
Jan 23, 2015
You need to know the Code if you are a franchisee or franchisor as the penalties are significant.
Xero users rejoice! Quoting has finally arrived
Jan 23, 2015
It has taken years, but Xero has at last added integrated quoting to its online accounting software.
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  35%
 
Your insurance company
  5%
 
A technology company (Google, Facebook et al)
  9%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  4%
 
A Federal Government agency (ATO, Centrelink etc)
  18%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  7%
TOTAL VOTES: 4065

Vote
Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
  27%
 
I DON'T support shutting the OAIC.
  73%
TOTAL VOTES: 1390

Vote