Re: IE7 Zero Day

[n3td3v <n3td3v () gmail com>]

On 5/7/06, 0x80 () hush ai <0x80 () hush ai> wrote:
> >Have you e-mailed secure () microsoft com and asked them if they want
>
> >to
> >make an offer? I know they've done private deals with security
> >researchers in the past, and trust me, they were offered a lot
> >more
>
> No I have not emailed Microsoft.  They are not entitled to any
> exlusivity.

Why not? Its their software that has the bug and they're the only ones
who can fix it. Its not just Microsoft you're going against here, its
the millions of Microsoft users you're holding to ransom here.

> >illegal auction. I think its in your best interest to e-mail
> >secure () microsoft com.
>
> Illegal?  Tell me what law in what country I have broken.

Tell me which country you're in, and then we can talk about how
illegal your ransom against Microsoft and its consumers is.

> >
> >1) You don't want to make as much money as you could by offering
> >Microsoft to buy your vulnerability in private.
>
> Like I said.  MS can offer just like anyone else but they do not
> get any special treatment.

Thats not the way it works. You must contact Microsoft first to setup
a dialog between each other.

> >2) You want to be held responsible for selling an exploit which
> >leads
> >to a major incident, worm, virus outrage.
>
> The vulnerabilities I have for sale could be used in such a way but
> I am in no way responsible for what the purhcaser uses it for.

Don't be so sure of your legal saftey.
I don't think you would ever get the chance to risk a major incident,
you would just be arrested, have the money and vulnerability handed to
Microsoft and you slammed into jail. Any which way, you're going to be
the loser out of this, not Microsoft. Trust me, the intelligence
services are already monitoring communications between you and anyone
else regarding your sale, do the right thing, save your own skin,
e-mail secure () microsoft com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/