full-disclosure - Re: ISS vs. Cisco: Chapter 2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu Aug 11 16:51:21 2005
From: fw at deneb.enyo.de (Florian Weimer)
Subject: Re: ISS vs. Cisco: Chapter 2

FX wrote:

> I leave the ethical aspects of this request by ISS for the consideration 
> of the inclined reader.

They have to collect exploits to write shell code for their IDS
products, otherwise they can't create signatures.  I recall a similar
request and it included this piece of information.

Of course, this doesn't make this activity less questionable.  You
normally don't see it because usually, ISS and others can obtain
exploits quietly through "responsible disclosure", especially if ISS
serves as a coordinator or is somehow involved (via IT-ISAC, for
example).