full-disclosure - IE7 Zero Day

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3a166c090605071359k1578fbfbk415c205b2e0bac64@mail.gmail.com>
Date: Sun May  7 21:59:55 2006
From: n3td3v at gmail.com (n3td3v)
Subject: IE7 Zero Day

On 5/7/06, 0x80@...h.ai <0x80@...h.ai> wrote:
> >Have you e-mailed secure@...rosoft.com and asked them if they want
>
> >to
> >make an offer? I know they've done private deals with security
> >researchers in the past, and trust me, they were offered a lot
> >more
>
> No I have not emailed Microsoft.  They are not entitled to any
> exlusivity.

Why not? Its their software that has the bug and they're the only ones
who can fix it. Its not just Microsoft you're going against here, its
the millions of Microsoft users you're holding to ransom here.

>
> >illegal auction. I think its in your best interest to e-mail
> >secure@...rosoft.com.
>
> Illegal?  Tell me what law in what country I have broken.

Tell me which country you're in, and then we can talk about how
illegal your ransom against Microsoft and its consumers is.

>
> >
> >1) You don't want to make as much money as you could by offering
> >Microsoft to buy your vulnerability in private.
>
> Like I said.  MS can offer just like anyone else but they do not
> get any special treatment.

Thats not the way it works. You must contact Microsoft first to setup
a dialog between each other.

>
> >2) You want to be held responsible for selling an exploit which
> >leads
> >to a major incident, worm, virus outrage.
>
> The vulnerabilities I have for sale could be used in such a way but
> I am in no way responsible for what the purhcaser uses it for.

Don't be so sure of your legal saftey.
I don't think you would ever get the chance to risk a major incident,
you would just be arrested, have the money and vulnerability handed to
Microsoft and you slammed into jail. Any which way, you're going to be
the loser out of this, not Microsoft. Trust me, the intelligence
services are already monitoring communications between you and anyone
else regarding your sale, do the right thing, save your own skin,
e-mail secure@...rosoft.com