full-disclosure - IE7 Zero Day

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060508004111.EA9EDDA822@mailserver7.hushmail.com>
Date: Mon May  8 01:41:23 2006
From: 0x80 at hush.ai (0x80@...h.ai)
Subject: IE7 Zero Day

There is no skin to save.  No law is being broken and I am not 
holding anyone ransom.

Microsoft is not the only vendor that can fix this bug either, it 
would be easy to patch the DLLs involved.

No one is monitoring anything because I have not broken any laws in 
any country.  You reply simply dances around the issue because as 
usual, you have zero idea what you are talking about.

On Sun, 07 May 2006 13:59:47 -0700 n3td3v <n3td3v@...il.com> wrote:
>On 5/7/06, 0x80@...h.ai <0x80@...h.ai> wrote:
>> >Have you e-mailed secure@...rosoft.com and asked them if they 
>want
>>
>> >to
>> >make an offer? I know they've done private deals with security
>> >researchers in the past, and trust me, they were offered a lot
>> >more
>>
>> No I have not emailed Microsoft.  They are not entitled to any
>> exlusivity.
>
>Why not? Its their software that has the bug and they're the only 
>ones
>who can fix it. Its not just Microsoft you're going against here, 
>its
>the millions of Microsoft users you're holding to ransom here.
>
>>
>> >illegal auction. I think its in your best interest to e-mail
>> >secure@...rosoft.com.
>>
>> Illegal?  Tell me what law in what country I have broken.
>
>Tell me which country you're in, and then we can talk about how
>illegal your ransom against Microsoft and its consumers is.
>
>>
>> >
>> >1) You don't want to make as much money as you could by 
>offering
>> >Microsoft to buy your vulnerability in private.
>>
>> Like I said.  MS can offer just like anyone else but they do not
>> get any special treatment.
>
>Thats not the way it works. You must contact Microsoft first to 
>setup
>a dialog between each other.
>
>>
>> >2) You want to be held responsible for selling an exploit which
>> >leads
>> >to a major incident, worm, virus outrage.
>>
>> The vulnerabilities I have for sale could be used in such a way 
>but
>> I am in no way responsible for what the purhcaser uses it for.
>
>Don't be so sure of your legal saftey.
>I don't think you would ever get the chance to risk a major 
>incident,
>you would just be arrested, have the money and vulnerability 
>handed to
>Microsoft and you slammed into jail. Any which way, you're going 
>to be
>the loser out of this, not Microsoft. Trust me, the intelligence
>services are already monitoring communications between you and 
>anyone
>else regarding your sale, do the right thing, save your own skin,
>e-mail secure@...rosoft.com
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/



Concerned about your privacy? Instantly send FREE secure email, no account required
http://www.hushmail.com/send?l=480

Get the best prices on SSL certificates from Hushmail
https://www.hushssl.com?l=485