I could be wrong on this; it could just be some M$ FUD I picked up somewhere, but I heard the LSASS patch was actually released and out for a couple weeks. Speculation then pointing to RE'ing the patch to find the exploit. I give him props though, assuming he found a way to exploit the vulnerability on his own regardless of how he became aware of the bug. I mean, the kids 18 right? Hell, I can't [never tried to] write/inject shellcode and I'm 25. Besides cleaning up Sasser all week got me out of the office where I didn't have to deal with my schizo boss, I'd *almost* pay money for that.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/8581/26221#26221