Conversation

Notices

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Thursday, 27-Feb-2025 07:09:18 JST Will Dormann

   Me to a major vendor, in a PGP-encrypted email (their request):
   Describes vul in their software. Here's an animated GIF showing exploitation of the vul. Please let me know how I can get a large file to you so I can get the PoC to you.

   Vendor (in cleartext): Please send us a GIF and the PoC.

   Me: I already sent the GIF. Are you saying you didn't get it? Also, please tell me how to get a large file to you.

   Vendor: We have not received the GIF. Please send us a PoC.

   Me: table_fip.gif
   I fully understand why people go the full disclosure route.

   • Embed this notice
     Will Dormann (wdormann@infosec.exchange)'s status on Thursday, 27-Feb-2025 07:09:18 JST Will Dormann

     in reply to

     A different vendor (Broadcom):

     We encourage finders to use encrypted communication channels to protect the confidentiality of vulnerability reports. Our PGP public key is available at the following link:

     The PGP key:

   • Embed this notice
     Will Dormann (wdormann@infosec.exchange)'s status on Tuesday, 04-Mar-2025 22:41:55 JST Will Dormann

     in reply to

     Me to Tend Micro ZDI:
     Trend Micro Antivirus fails to detect viruses in a mounted VHD/VHDX file at all. You should probably fix this.

     Trend Micro ZDI:

     we are not interested in this vulnerability type.

     This truly is a thankless job. 🤦♂️

   • Embed this notice
     翠星石 (suiseiseki@freesoftwareextremist.com)'s status on Tuesday, 04-Mar-2025 22:41:55 JST 翠星石

     in reply to
     @wdormann >Proprietary malware developers aren't interested in carrying out extra work detecting certain kinds of proprietary malware.
     Is that meant to be a surprise?
   • Embed this notice
     Will Dormann (wdormann@infosec.exchange)'s status on Tuesday, 04-Mar-2025 22:41:56 JST Will Dormann

     in reply to

     A yet-another large vendor, after having received the vulnerability report through the mechanism of their choice (PGP email):

     would be possible provide .zip attachment with password protected?

   • Embed this notice
     Will Dormann (wdormann@infosec.exchange)'s status on Tuesday, 04-Mar-2025 22:41:56 JST Will Dormann

     in reply to

     Another large vendor to me, after providing a working PoC to them:

     How can an attacker create this PoC?

     Me: I dunno, it comes to them in a dream, like with Mendeleev?

     How does this even matter?

     scriptjunkie repeated this.