bugtraq - RE: 0day: PDF pwns Windows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <F9C0B32C4FFE7147BD0FF6A40BE806E701ABEE@Hammer_Exchange.hammerofgod.com>
Date: Tue, 25 Sep 2007 11:39:24 -0700
From: "Thor (Hammer of God)" <thor@...merofgod.com>
To: <bugtraq@...urityfocus.com>
Cc: "Chad Perrin" <perrin@...theon.com>,
	"Crispin Cowan" <crispin@...ell.com>, <Casper.Dik@....COM>,
	"Gadi Evron" <ge@...uxbox.org>,
	"pdp (architect)" <pdp.gnucitizen@...glemail.com>,
	<full-disclosure@...ts.grok.org.uk>,
	"Lamont Granquist" <lamont@...iptkiddie.org>,
	"Roland Kuhn" <rkuhn@....physik.tu-muenchen.de>
Subject: RE: 0day: PDF pwns Windows

For the record, the original term "O-Day" was coined by a dyslexic
security engineer who listened to too much Harry Belafonte while working
all night on a drink of rum.  It's true.  Really.
 
t

> -----Original Message-----
> From: Roland Kuhn [mailto:rkuhn@....physik.tu-muenchen.de]
> Sent: Tuesday, September 25, 2007 10:58 AM
> To: Lamont Granquist
> Cc: Chad Perrin; Crispin Cowan; Casper.Dik@....COM; Gadi Evron; pdp
> (architect); bugtraq@...urityfocus.com; full-
> disclosure@...ts.grok.org.uk
> Subject: Re: 0day: PDF pwns Windows
> 
> On 25 Sep 2007, at 00:57, Lamont Granquist wrote:
> 
> > The exploit is not made public by its use.  The exploit is not even
> > made public by (back-channel) sharing amongst the hacker/cracker
> > community. The exploit is only made public if detected or the
> > vulnerability is disclosed.  Until detected/disclosed the hacker/
> > cracker can use their 31337 0day spl01tz to break into whichever
> > vulnerable machines they like. 0day exploits are valuable because
the
> > opposition is ignorant of them.
> >
> > Posting exploits to BUGTRAQ, however, inherently makes them not
> > 0day...
> 
> And my ignorant self thought until this thread that the "0" in the
term
> referred to the number of days of head start granted to the vendor.
> Silly me. Because that would make all vulnerabilities published
without
> prior warning to the vendor a "0day"...
> 
> Roland (who seems to remember that this was once the meaning of this
> term)