full-disclosure - no more public exploits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <408EC652.60101@immunitysec.com>
From: dave at immunitysec.com (Dave Aitel)
Subject: no more public exploits

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Well, if it's that much of an issue, you can always buy your exploits
from a commercial source, such as Immunity
(http://www.immunitysec.com/CANVAS/ . We have an LSASS (one exploit
fits all) and a PCT exploit (ported from SP0-4), so you can show all
your management exactly why they should patch. And you can also feel
secure that the exploits you download aren't trojaned when you're
using something with commercial support. At $995 for a full site
license, including source, CANVAS is cheaper than the alternative...

Dave Aitel
Immunity, Inc.

Ng, Kenneth (US) wrote:

| I agree, tis a shame.  So many places I know that refuse to patch
| until someone can show them an actual exploit that goes crashing
| through their defenses.  After all, "we have a firewall in place".
| After all, "...Microsoft (or insert almost any other vendor) says
| they are secure". After all, "why would someone hack us?".
| Unfortunately they don't realize that just because I don't have a
| tool that will do this doesn't mean that someone out on the net
| doesn't.
|
| -----Original Message----- From:
| full-disclosure-admin@...ts.netsys.com
| [mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Yabby
| Sent: Tuesday, April 27, 2004 1:06 PM To: johnny cyberpunk;
| full-disclosure@...ts.netsys.com Subject: Re: [Full-Disclosure] no
| more public exploits
|
|
| Even though I think that the publication of your code might have
| been a couple of weeks too soon: too bad you chose to abandon full
| disclosure. A lot of people do not have the skills to transform
| theoretical vulnerabilities into practical exploits. With the lack
| of proof that the vulnerability can really be exploited, a lot of
| sysadmins will decide not to patch, leaving the holes in tact for
| the real blackhats, that have possession of the malicious code
| anyway....
|
| maarten
|
|> this is an anouncement that i personally have no more intention
|> to publish any
|
|
| _______________________________________________ Full-Disclosure -
| We believe in it. Charter:
| http://lists.netsys.com/full-disclosure-charter.html
|
|
|
*****************************************************************************
|  The information in this email is confidential and may be legally
| privileged. It is intended solely for the addressee. Access to this
| email by anyone else is unauthorized.
|
| If you are not the intended recipient, any disclosure, copying,
| distribution or any action taken or omitted to be taken in reliance
| on it, is prohibited and may be unlawful. When addressed to our
| clients any opinions or advice contained in this email are subject
| to the terms and conditions expressed in the governing KPMG client
| engagement letter.
|
*****************************************************************************
|
|
| _______________________________________________ Full-Disclosure -
| We believe in it. Charter:
| http://lists.netsys.com/full-disclosure-charter.html

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAjsZSzOrqAtg8JS8RAiPnAKCDo9DtSSFwAmAYK2t59qZXOULTlQCg2aba
SwUDLWjudVVbie0Fqcs8PMo=
=/tz5
-----END PGP SIGNATURE-----