|
osdir.com mailing list archive |
|
Subject: Re: The lack of hard questions - msg#00000List: security.dailydaveHey folks – we’re here, watching this thread. Send us your questions, either directly to msrcteam@xxxxxxxxxxxxx or to the list. We’ll answer them here:blogs.technet.com/ecostrat in a future post. From:
dailydave-bounces@xxxxxxxxxxxxxxxxxxxxx
[mailto:dailydave-bounces@xxxxxxxxxxxxxxxxxxxxx] On Behalf Of Dave Aitel
I didn't get to see the talk,
so I'm not sure what questions you asked and what the answers were. Of course,
you can feel free to ask them here. Peer review isn't a static thing. On Tue, Aug 26, 2008 at 4:48 PM, security curmudgeon <jericho@xxxxxxxxxxxxx> wrote:
: World *Mike Reavey, Steve
Adegbite, Katie Moussouris* Their "hard
questions" in the slides were far from hard. I think you had _______________________________________________ Dailydave mailing list Dailydave@xxxxxxxxxxxxxxxxxxxxx http://lists.immunitysec.com/mailman/listinfo/dailydave Thread at a glance:
Next Message by Date: click to view message previewRe: The lack of hard questionsBut the problem is, if there are only a handful of people who can make a reliable exploit for a particular vulnerability (or not) and none of them work for MS, how can MS accurately determine whether an exploit for a particular vulnerability will be somewhat reliable or totally reliable (or not possible at all)? Doesn't anyone remember gobbles :) On Aug 27, 2008, at 4:55 PM, Valdis.Kletnieks@xxxxxx wrote: > On Wed, 27 Aug 2008 09:05:42 EDT, Pusscat said: >> My assumption would be that if it can be made reliable by anyone, >> then it's >> reliable. It probably shouldn't be a quantum value, collapsed by our >> inability ;) > > Yes, it only has to be weaponized once. Next Message by Thread: click to view message previewRe: The lack of hard questionsMike Reavey writes: -+----------------- | Hey folks - we're here, watching this thread. Send us your | questions, either directly to msrcteam@xxxxxxxxxxxxx or to the | list. We'll answer them here:blogs.technet.com/ecostrat in a | future post. One question I've always wanted to know is based on partial knowledge on my part. As I recall the story -- and this is subject to correction -- back when one CD's worth of Windows source was posted on the Internet new exploits began appearing in perhaps a fortnight. That was interesting inasmuch as it proved that amateurs could do it via source analysis and, which is more, this is about the time when MSFT began providing source to a number of governments as part of the monopoly defense -- including countries had (have) competent national laboratories, e.g., Russia. So my questions: what sort of vulns do you get back from foreign governments and, assuming that they don't share except with you, how often are what those governments discover previously unknown, how often are the vulns that are discovered discovered independently, and do you ever see exploits of vulns that have only been identified by governments (and do those exploits correlate with the nature of who is doing the discovering)? A white paper on your efforts to avoid being a vector of cyber warfare would serve, should one be handy. In respect, --dan Loading Comments...
|
|
