Contact information for Microsoft Security Response Center [tf]

[Microsoft Security Response Center]

-----BEGIN PGP SIGNED MESSAGE-----

Periodically we hear people say they tried to contact Microsoft about
a product or service vulnerability and that Microsoft didn't respond.
We are concerned that people may not know how to report security
vulnerabilities to Microsoft.
=20
The Microsoft Security Response Center investigates all reports of
security vulnerabilities affecting Microsoft products. If you believe
you have found a security vulnerability affecting a Microsoft
product, we'd like to work with you to investigate it.=20
=20
You can contact the Microsoft Security Response Center by emailing
secure@microsoft.com directly, or you can submit your report via our
web-based vulnerability reporting form located at
https://www.microsoft.com/technet/treeview/default.asp?url=3D/technet/se
curity/bulletin/alertus.asp.

Sincerely,
Microsoft Security Response Center

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1

iQEVAwUBPwSbDI0ZSRQxA/UrAQH63Af/b+QJk1jCTiTBkNIpphqSOlA5tFgqYkBf
Iip5FnEXF/2QJsW8YVbmupnLnnH2ig8HxzpVqzGZ69QhYttpNmmf8v35NcGQ AdcU
fYEKDl2SJxLxPiUPo6kAcO0yh/b37o/yqT/dfySn1gI2JDVCmhcOD/UM0eYEayIQ
yH24oxAJVNGy88SZXd41zU3BSz61hyAmeQOLOuHkUIG9FWSMUa T0MA7dr6wdyI7Q
ofCyhx+hmIC2RIShyhNu9Nt2xl+f8iJajzn9VorpsqrYCx/Pf8CixfL5di2HZUaN
kqWBimMETruC0P16quVzFZcKxCaPi+qJg4qt30oc1R1B+votpt MlAA=3D=3D
=3DPkAX
-----END PGP SIGNATURE-----

Why do you people insist on using such an unobvious address? Do you have
a catch-all in place?

secure@microsoft.com is a whimsical address almost as silly as designating
"abuse@microsoft.com" to "badstuff@microsoft.com".

If check where those people you heard saying they tried to contact you
tried first, you would see that the first and most logical address would
be security@microsoft.com

I really do hope you have that address monitored as well, because as
long as you are in existence, people will not learn what the correct
address is and where to burrow down on your site to make submissions.

Can you confirm that this address security@microsoft.com is being monitored
as well.

/.../.../.../.../.../.../.../.../.../.../.../


Microsoft Security Response Center:

Periodically we hear people say they tried to contact Microsoft about
a product or service vulnerability and that Microsoft didn't respond.
We are concerned that people may not know how to report security
vulnerabilities to Microsoft.

The Microsoft Security Response Center investigates all reports of
security vulnerabilities affecting Microsoft products. If you believe
you have found a security vulnerability affecting a Microsoft
product, we'd like to work with you to investigate it.

You can contact the Microsoft Security Response Center by emailing
secure@microsoft.com directly, or you can submit your report via our
web-based vulnerability reporting form located at
https://www.microsoft.com/technet/treeview/default.asp?url=/technet/se
curity/bulletin/alertus.asp.

Sincerely,
Microsoft Security Response Center

/.../.../.../.../.../.../.../.../.../.../.../



Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program:
https://www.hushmail.com/about.php?subloc=affiliate&l=427

[Nexus]

----- Original Message -----
From: <keepitsecret@hush.com>
To: <bugtraq@securityfocus.com>
Sent: Friday, July 04, 2003 7:31 PM
Subject: Re: Contact information for Microsoft Security Response Center [tf]


>
> Why do you people insist on using such an unobvious address? Do you have
> a catch-all in place?

By unobvious I assume you mean "can't be arsed to spend 5 seconds searching
for it" ?
Let's see...
http://www.google.co.uk/search?q=microsoft+security+contact&ie=UTF-8&oe=UTF-8&hl=en&meta=

First hit :

http://www.microsoft.com/technet/security/contact.asp

Simple drop-down menu and then the web form. Damn, that was a pain...

> If check where those people you heard saying they tried to contact you
> tried first, you would see that the first and most logical address would
> be security@microsoft.com

Righto...

http://www.google.co.uk/search?hl=en&ie=UTF-8&oe=UTF-8&q=security@microsoft.com&meta=

First hit :

http://www.securityfocus.com/news/545

And there's an SF article about Microsoft wishing to move security
notifications from email (secure@microsoft.com as mentioned in that very
article) to the web-based form so cunningly previously enumerated. Both
methods are thus obtained in less time than it took to write this email.
Some vendors are a damn site harder to track down, let alone them ignoring
you unless you have a support contract - you might want to pick a better
example of this ? Mind you, I have to type with a blunt crayon held
between my teeth as along with the straight-jackets, no sharp objects are
allowed here ;-)

Cheers.

[=?Windows-1252?Q?David_A._P=E9rez?=]

Hi,

> Can you confirm that this address security@microsoft.com is being
monitored
> as well.

I've sent messages in the past to security@microsoft.com and all of them
where properly handled.

Salu2,

David A. Pérez

http://www.kamborio.com/
_ _ _
| | __ __ _ _ __ ___ | |__ ___ _ __ (_) ___
| |/ / / _` || '_ ` _ \ | '_ \ / _ \ | '__|| | / _ \
| < | (_| || | | | | || |_) || (_) || | | || (_) |
|_|\_\ \__,_||_| |_| |_||_.__/ \___/ |_| |_| \___/
El perdón es la venganza de los buenos (anónimo)