BugTraq
0day: PDF pwns Windows Sep 20 2007 01:21PM
pdp (architect) (pdp gnucitizen googlemail com) (3 replies)
Re: [Full-disclosure] 0day: PDF pwns Windows Sep 21 2007 07:53PM
Thierry Zoller (Thierry Zoller lu) (2 replies)
Re: [Full-disclosure] 0day: PDF pwns Windows Sep 21 2007 09:21PM
Aaron Collins (collinsa ehawaii gov)
Re: [Full-disclosure] 0day: PDF pwns Windows Sep 21 2007 09:21PM
Kevin Finisterre (lists) (kf_lists digitalmunition com)
Re: 0day: PDF pwns Windows Sep 20 2007 04:55PM
Aditya K Sood (zeroknock secniche org)
Re: 0day: PDF pwns Windows Sep 20 2007 03:29PM
Gadi Evron (ge linuxbox org) (1 replies)
Re: 0day: PDF pwns Windows Sep 20 2007 11:16PM
Crispin Cowan (crispin novell com) (2 replies)
Re: 0day: PDF pwns Windows Sep 23 2007 05:34AM
Crispin Cowan (crispin novell com) (2 replies)
Re: 0day: PDF pwns Windows Sep 25 2007 04:15PM
Iggy E (iggy_e yahoo com)
Re: 0day: PDF pwns Windows Sep 23 2007 11:52PM
Chad Perrin (perrin apotheon com) (2 replies)
Re: 0day: PDF pwns Windows Sep 24 2007 10:57PM
Lamont Granquist (lamont scriptkiddie org) (1 replies)
Re: 0day: PDF pwns Windows Sep 25 2007 05:57PM
Roland Kuhn (rkuhn e18 physik tu-muenchen de) (1 replies)
RE: 0day: PDF pwns Windows Sep 25 2007 06:39PM
Thor (Hammer of God) (thor hammerofgod com) (2 replies)
Re: 0day: PDF pwns Windows Sep 25 2007 09:03PM
Steve Shockley (steve shockley shockley net)
defining 0day Sep 25 2007 07:02PM
Gadi Evron (ge linuxbox org) (3 replies)
RE: defining 0day Sep 25 2007 09:20PM
David Gillett (gillettdavid fhda edu)
Re: defining 0day Sep 25 2007 08:40PM
Charles Miller (cmiller pastiche org) (2 replies)
Re: defining 0day Sep 26 2007 11:25PM
Zow Terry Brugger (zow llnl gov) (1 replies)
Re: defining 0day Sep 26 2007 11:10PM
Chad Perrin (perrin apotheon com) (1 replies)
RE: defining 0day Sep 28 2007 12:20AM
Marvin Simkin (Marvin Simkin asu edu) (1 replies)
Re: defining 0day Sep 27 2007 06:34PM
Chad Perrin (perrin apotheon com)
Re: defining 0day Sep 25 2007 08:57PM
Gadi Evron (ge linuxbox org)
On Wed, 26 Sep 2007, Charles Miller wrote:
> On 26/09/2007, at 5:02 AM, Gadi Evron wrote:
>
>> Okay. I think we exhausted the different views, and maybe we are now able
>> to come to a conlusion on what we WANT 0day to mean.
>>
>> What do you, as professional, believe 0day should mean, regardless of
>> previous definitions?
>
> As a professional, I would be happy to see terms like '0day' banished from
> the lexicon entirely. It's an essentially meaningless -- all third-party
> exploits are zero-day to _somebody_ -- term of boast co-opted from the warez
> scene, and we can do perfectly well without it.
>
> Quibbling over its precise definition seems a ridiculous waste of bytes.
>

It would if we are to stay stuck in our niche, but you need to remember -
security is about niches, we are all experts -- but in very specific
fields.

These past 2 years we faced multiple targeted attacks with previously
unknown vulnerabilities. We experience MASSIVE exploitation of users with
0days used on web sites and ine mail, etc.

As an industry, as professionals, it is time to get our act together on
the basics.

I am operations manager for ZERT, and for me, this is indeed at the very
heart of the matter. How you define this silliness is directly linked to
how you do two of the most essential parts of security:

1. Vulnerability disclosure - for researchers.

2. Incident response - for.. responders.

If a vulnerabiliy is fully disclosed, unpatched, being actively exploited,
etc. caused real confusion, and non of us, or any of the written material,
can agree on the basics.

It's not about fighting on what 0day means as much as it is about how we
as an industry, a community, conduct ourselves and can reach a common
language, which directly impacts operations.

So, if WMF was disclosed today after being actively exploited itw for a
while, what would you call it? How would you respond to it? How long would
it stay unpatched and when will you realize its importance?

> C

Gadi.

[ reply ]
Re: defining 0day Sep 25 2007 07:51PM
Brian Loe (knobdy gmail com) (1 replies)
Re: defining 0day Sep 25 2007 07:59PM
Gadi Evron (ge linuxbox org) (1 replies)
Re: defining 0day Sep 25 2007 08:15PM
Brian Loe (knobdy gmail com) (1 replies)
Re: defining 0day Sep 25 2007 08:37PM
Adrian Griffis (adriang63 gmail com) (2 replies)
Re: defining 0day Sep 25 2007 09:05PM
Andrew Weaver (aweaver ee net)
Re: defining 0day Sep 25 2007 08:54PM
Brian Loe (knobdy gmail com)
Re: 0day: PDF pwns Windows Sep 24 2007 09:59PM
Crispin Cowan (crispin novell com) (1 replies)
Re: [Full-disclosure] 0day: PDF pwns Windows Sep 25 2007 01:39PM
J. Oquendo (sil infiltrated net)
Re: 0day: PDF pwns Windows Sep 21 2007 06:34PM
Casper Dik Sun COM (1 replies)
Re: 0day: PDF pwns Windows Sep 21 2007 07:24PM
J. Oquendo (sil infiltrated net)


 

Privacy Statement
Copyright 2010, SecurityFocus