Daylight come and me wanna go home...
This one time, at band camp, Thor (Hammer of God) wrote:
For the record, the original term "O-Day" was coined by a dyslexic
security engineer who listened to too much Harry Belafonte while working
all night on a drink of rum. It's true. Really.
t
-----Original Message-----
From: Roland Kuhn [mailto:rkuhn@e18.physik.tu-muenchen.de]
Sent: Tuesday, September 25, 2007 10:58 AM
To: Lamont Granquist
Cc: Chad Perrin; Crispin Cowan; Casper.Dik@Sun.COM; Gadi Evron; pdp
(architect); bugtraq@securityfocus.com; full-
disclosure@lists.grok.org.uk
Subject: Re: 0day: PDF pwns Windows
On 25 Sep 2007, at 00:57, Lamont Granquist wrote:
The exploit is not made public by its use. The exploit is not even
made public by (back-channel) sharing amongst the hacker/cracker
community. The exploit is only made public if detected or the
vulnerability is disclosed. Until detected/disclosed the hacker/
cracker can use their 31337 0day spl01tz to break into whichever
vulnerable machines they like. 0day exploits are valuable because
the
opposition is ignorant of them.
Posting exploits to BUGTRAQ, however, inherently makes them not
0day...
And my ignorant self thought until this thread that the "0" in the
term
referred to the number of days of head start granted to the vendor.
Silly me. Because that would make all vulnerabilities published
without
prior warning to the vendor a "0day"...
Roland (who seems to remember that this was once the meaning of this
term)
--
Lawrence MacIntyre 865.574.8696 macintyrelp@ornl.gov
Oak Ridge National Laboratory
Cyber Security and Information Infrastructure Research Group
Protect your digital freedom and privacy, eliminate DRM.
Learn more at http://www.defectivebydesign.org/what_is_drm
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
