full-disclosure - Re: 0day: PDF pwns Windows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-id: <46F95D97.906@ornl.gov>
Date: Tue, 25 Sep 2007 15:12:23 -0400
From: Lawrence Paul MacIntyre <macintyrelp@...l.gov>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: 0day: PDF pwns Windows

Daylight come and me wanna go home...

This one time, at band camp, Thor (Hammer of God) wrote:
> For the record, the original term "O-Day" was coined by a dyslexic
> security engineer who listened to too much Harry Belafonte while working
> all night on a drink of rum.  It's true.  Really.
>  
> t
>
>   
>> -----Original Message-----
>> From: Roland Kuhn [mailto:rkuhn@....physik.tu-muenchen.de]
>> Sent: Tuesday, September 25, 2007 10:58 AM
>> To: Lamont Granquist
>> Cc: Chad Perrin; Crispin Cowan; Casper.Dik@....COM; Gadi Evron; pdp
>> (architect); bugtraq@...urityfocus.com; full-
>> disclosure@...ts.grok.org.uk
>> Subject: Re: 0day: PDF pwns Windows
>>
>> On 25 Sep 2007, at 00:57, Lamont Granquist wrote:
>>
>>     
>>> The exploit is not made public by its use.  The exploit is not even
>>> made public by (back-channel) sharing amongst the hacker/cracker
>>> community. The exploit is only made public if detected or the
>>> vulnerability is disclosed.  Until detected/disclosed the hacker/
>>> cracker can use their 31337 0day spl01tz to break into whichever
>>> vulnerable machines they like. 0day exploits are valuable because
>>>       
> the
>   
>>> opposition is ignorant of them.
>>>
>>> Posting exploits to BUGTRAQ, however, inherently makes them not
>>> 0day...
>>>       
>> And my ignorant self thought until this thread that the "0" in the
>>     
> term
>   
>> referred to the number of days of head start granted to the vendor.
>> Silly me. Because that would make all vulnerabilities published
>>     
> without
>   
>> prior warning to the vendor a "0day"...
>>
>> Roland (who seems to remember that this was once the meaning of this
>> term)
>>     


-- 
  Lawrence MacIntyre   865.574.8696   macintyrelp@...l.gov
                Oak Ridge National Laboratory
Cyber Security and Information Infrastructure Research Group

Protect your digital freedom and privacy, eliminate DRM.
Learn more at http://www.defectivebydesign.org/what_is_drm

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/