Archive for the ‘CERT’ tag

Why even BOTHER reporting bugs to vendors?

Here it is – the argument for why the VulnDisco path is better than the CERT path or, that is to say, why it’s better to sell people tools that can be used to verify the fix (vendor or DIY) vs. only telling the vendor then relying on the vendor’s quality, honesty and other things vendors typically don’t seem to have.

I say that folks like Adobe should have even MORE interest in things like Immunity Early Access PLUS.  I mean really, why should I have to play middle-man between the researcher who wrote the plug-in and the vendor with the bug?  Because Adobe and others think they’re above paying a third party for insight into their own product’s quality.

via Security-Sucks » CVE-2010-0188, APSB10-07 PDF Exploit demonstration.

HNNCast110609

• YouLostIt CEO DDoS, Matt56444 Suicide, TCNiSO.net Indictment, IETF SSL Revamp, Disk Space Invaders

News:

• NK Officially to Blame by SK, Swedish Sites Swim with Fishes, the Evil Maid from Mossad
• Courtnee: Lockpicking
• iPhone Jailbreak Advisory, Copyright Wrongs, Money Mules Move Megabucks

Quickies:

• Str0ke’s Not Dead, DHS CERT, Round 1 Schmoo Tix Sold-Out, da p00p on w00p, This Week’s Worm Farm, KiwiCon Speakers Announced, B-Sides on Both Sides, QuahogCon CFP, NYC CSAW Awards, OSVDB Plea, SecurityTubeCon this Weekend, HitB CTF Binaries Posted, Spanish Systems Need a Scrub-Down

Stack of Shame:

• 110

Book Recommendation:

Hacking the Cable Modem: What Cable Companies Don't Want You to Know

Easy Access and Inflate-A-Wedge Kit - 2-Pc Mr. Smith's 11-Piece Professional Locksmith Lockpicking Kit Slim Jim Universal Lock Out Tool Set