News for hackers. Stuff that matters.

A comment on IE9 pwn2owned with 0-day with exploit working back from IE6 to IE10 on Windows 8.

Re:IE9 pwn2owned with 0-day with exploit working back from I... by michaelbuckbee on Friday March 09, 2012 @06:06AM (#3683643)
Am I wrong in assuming that Vupen's customers are bad people (for values of spam, trojans, bot-net, phishing bad)?

I'm trying to think of why else they wouldn't disclose the protected mode bypass error, but instead keep it "private for our customers".

[ Parent | on HN ]
Re:IE9 pwn2owned with 0-day with exploit working back from I... by reggplant on Friday March 09, 2012 @06:16AM (#3683661)
According to their website, they provide 'offensive exploit services' to governments and intelligence services. So possibly, depending on wether you view those people as bad people.
[ Parent | on HN ]
Re:IE9 pwn2owned with 0-day with exploit working back from I... by robtoo on Friday March 09, 2012 @08:49AM (#3683999)
They even admit it's not just governments they sell to: VUPEN customers include worldwide governments and major corporations in finance, technology and manufacturing. [http://www.vupen.com/english/company.php] although their continued use of weasel words does stop just short of admitting that they're enabling industrial espionage.
[ Parent | on HN ]
Re:IE9 pwn2owned with 0-day with exploit working back from I... by joering2 on Friday March 09, 2012 @02:06PM (#3685464)
VUPEN's offensive IT intrusion solutions and government grade exploits enable the Intelligence community and government agencies to achieve their lawful intercept missions using VUPEN's industry-recognized vulnerability research and intelligence.

I am trying to imagine a situation where _lawfuly_ government agencies need to break into someones IE. Any ideas?

[ Parent | on HN ]
Re:IE9 pwn2owned with 0-day with exploit working back from I... by iy56 on Friday March 09, 2012 @04:39PM (#3686079)
Collecting information pursuant to a legitimate search warrant?
[ Parent | on HN ]
Re:IE9 pwn2owned with 0-day with exploit working back from I... by joering2 on Friday March 09, 2012 @06:35PM (#3686470)
hmmm.. I think law enforcement agencies need to stay in accordance with the law even with their "discovery". Breaking into someone's IE or exploiting vulnerabilities in order to get information otherwise you wouldn't be able to get falls under breaking into someones "property", I think, even if its "just" an Internet browser.

Therefore, you "legitimate" search warrant will be thrown out of window by a judge, and classified as the Fruit of the poisonous tree.

http://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree

[ Parent | on HN ]
Re:IE9 pwn2owned with 0-day with exploit working back from I... by ward on Friday March 09, 2012 @06:14AM (#3683658)
I thought that too, at first, but it seemed to blatantly illegal to believe. Going by their site, it's mostly for government agencies against other agencies?[1] I'm not proficient enough at law to comment on the legalities of it.

Another possibility I had in mind is that they want to get paid by people wanting to fix this vulnerability on their systems. eg, company X will have to come to them if they want their IE browsers to receive the patch against this bug.

[1] http://www.vupen.com/english/services/lea-index.php

[ Parent | on HN ]
Re:IE9 pwn2owned with 0-day with exploit working back from I... by Tossrock on Friday March 09, 2012 @04:11PM (#3685960)
I'm not proficient at law either, but I don't think selling exploits is illegal. Unauthorized computer access is, but as long as they aren't doing that access themselves, I think they're in the clear. The analogy I first think of would be a gun store owner not being responsible for the crimes his customers commit. Although perhaps he'd be an accessory if he knew they had criminal intentions? I'm not sure.
[ Parent | on HN ]
Re:IE9 pwn2owned with 0-day with exploit working back from I... by gcp on Friday March 09, 2012 @06:17AM (#3683663)
Their customers are "Law enforcement agencies and governments". At least officially. But that's scary enough.
[ Parent | on HN ]
Re:IE9 pwn2owned with 0-day with exploit working back from I... by Roritharr on Friday March 09, 2012 @08:10AM (#3683897)
The German law enforcement agencies is said to have been a customer of Vupen.
[ Parent | on HN ]
Re:IE9 pwn2owned with 0-day with exploit working back from I... by sliverstorm on Friday March 09, 2012 @04:02PM (#3685914)
At least they appear to be too high-profile and above-ground to have criminals as their main clients.
[ Parent | on HN ]