On 5/7/06, 0x80 () hush ai <0x80 () hush ai> wrote:
Have you e-mailed secure () microsoft com and asked them if they
want
to
make an offer? I know they've done private deals with security
researchers in the past, and trust me, they were offered a lot
more
No I have not emailed Microsoft. They are not entitled to any
exlusivity.
Why not? Its their software that has the bug and they're the only
ones
who can fix it. Its not just Microsoft you're going against here,
its
the millions of Microsoft users you're holding to ransom here.
illegal auction. I think its in your best interest to e-mail
secure () microsoft com
Illegal? Tell me what law in what country I have broken.
Tell me which country you're in, and then we can talk about how
illegal your ransom against Microsoft and its consumers is.
1) You don't want to make as much money as you could by
offering
Microsoft to buy your vulnerability in private.
Like I said. MS can offer just like anyone else but they do not
get any special treatment.
Thats not the way it works. You must contact Microsoft first to
setup
a dialog between each other.
2) You want to be held responsible for selling an exploit which
leads
to a major incident, worm, virus outrage.
The vulnerabilities I have for sale could be used in such a way
but
I am in no way responsible for what the purhcaser uses it for.
Don't be so sure of your legal saftey.
I don't think you would ever get the chance to risk a major
incident,
you would just be arrested, have the money and vulnerability
handed to
Microsoft and you slammed into jail. Any which way, you're going
to be
the loser out of this, not Microsoft. Trust me, the intelligence
services are already monitoring communications between you and
anyone
else regarding your sale, do the right thing, save your own skin,
e-mail secure () microsoft com
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Intro
