Amen!
KF is 100% on the money. I can arrange the legitimate purchase of most
working exploits for significantly more money than iDefense, In some cases
over $75,000.00 per purchase. The company that I am working with has a
relationship with a legitimate buyer, all transactions are legal. If you're
interested contact me and we'll get the ball rolling.

-Simon
=20

$8000.00 USD is low!

On 1/16/07 12:29 PM, "K F (lists)" <kf_lists@digitalmunition.com> wrote:

> No offense to iDefense as I have used their services in the past... but
> MY Q1 2007 Challenge to YOU is to start offering your researchers more
> money in general! I've sold remotely exploitable bugs in random 3rd
> party products for more $$ than you are offering for these Vista items
> (see the h0n0 #3). I really think you guys are devaluing the exploit
> market with your low offers... I've had folks mail me like WOW iDefense
> offered me $800 for this remote exploit. Pfffttt not quite.
>=20
> We all know black hats are selling these sploits for <=3D$25k so why
> should the legit folks settle for anything less? As an example the guys
> at MOAB kicked around selling a Quicktime bug to iDefense but in the end
> we decided it was not worth it due to low pay...
>=20
> Low Pay =3D=3D Not getting disclosed via iDefense....
>=20
> -KF
>=20
>=20
>> I know someone who will pay significantly more per vulnerability against=
the
>> same targets.=20
>>=20
>>=20
>> On 1/10/07 12:27 PM, "contributor" <Contributor@idefense.com> wrote:
>>=20
>> =20
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> =20
>> Hash: SHA1
>> =20
>> Also available at:
>>=20
>>=20
>> =20
>>> http://labs.idefense.com/vcp/challen...+vulnerabilit=
y+cha
>>> ll
>>> enge
>>> =20
>>=20
>> *Challenge Focus: Remote Arbitrary Code Execution Vulnerabilities
>> =20
>>> in
>>> =20
>> Vista & IE 7.0*
>>=20
>> Both Microsoft Internet Explorer and Microsoft Windows
>> =20
>>> dominate their
>>> =20
>> respective markets, and it is not surprising that the decision
>> =20
>>> to
>>> =20
>> update to the current release of Internet Explorer 7.0 and/or Windows
>> Vista
>> =20
>>> is fraught with uncertainty. Primary in the minds of IT
>>> =20
>> security
>> =20
>>> professionals is the question of vulnerabilities that may be
>>> =20
>> present in these
>> =20
>>> two groundbreaking products.
>>> =20
>>=20
>> To help assuage this uncertainty, iDefense Labs
>> =20
>>> is pleased to announce
>>> =20
>> the Q1, 2007 quarterly challenge.
>>=20
>> Remote Arbitrary
>> =20
>>> Code Execution Vulnerabilities in Vista and IE 7.0
>>> =20
>>=20
>> Vulnerability
>> =20
>>> Challenge:
>>> =20
>> iDefense will pay $8,000 for each submitted vulnerability that
>> =20
>>> allows
>>> =20
>> an attacker to remotely exploit and execute arbitrary code on either
>> of
>> =20
>>> these two products. Only the first submission for a given
>>> =20
>> vulnerability will
>> =20
>>> qualify for the award, and iDefense will award no
>>> =20
>> more than six payments of
>> =20
>>> $8000. If more than six submissions
>>> =20
>> qualify, the earliest six submissions
>> =20
>>> (based on submission date and
>>> =20
>> time) will receive the award. The iDefense Team
>> =20
>>> at VeriSign will be
>>> =20
>> responsible for making the final determination of whether
>> =20
>>> or not a
>>> =20
>> submission qualifies for the award. The criteria for this phase
>> =20
>>> of
>>> =20
>> the challenge are:
>>=20
>> I) Technologies Covered:
>> - - Microsoft Internet
>> =20
>>> Explorer 7.0
>>> =20
>> - - Microsoft Windows Vista
>>=20
>> II) Vulnerability Challenge
>> =20
>>> Ground Rules:
>>> =20
>> - - The vulnerability must be remotely exploitable and must
>> =20
>>> allow
>>> =20
>> arbitrary code execution in a default installation of one of
>> =20
>>> the
>>> =20
>> technologies listed above
>> - - The vulnerability must exist in the
>> =20
>>> latest version of the
>>> =20
>> affected technology with all available patches/upgrades
>> =20
>>> applied
>>> =20
>> - - 'RC' (Release candidate), 'Beta', 'Technology Preview'
>> =20
>>> and
>>> =20
>> similar versions of the listed technologies are not included in
>> =20
>>> this
>>> =20
>> challenge
>> - - The vulnerability must be original and not previously
>> =20
>>> disclosed
>>> =20
>> either publicly or to the vendor by another party
>> - - The
>> =20
>>> vulnerability cannot be caused by or require any additional
>>> =20
>> third party
>> =20
>>> software installed on the target system
>>> =20
>> - - The vulnerability must not
>> =20
>>> require additional social engineering
>>> =20
>> beyond browsing a malicious
>> =20
>>> site
>>> =20
>>=20
>> Working Exploit Challenge:
>> In addition to the $8000 award for the
>> =20
>>> submitted vulnerability,
>>> =20
>> iDefense will pay from $2000 to $4000 for working
>> =20
>>> exploit code that
>>> =20
>> exploits the submitted vulnerability. The arbitrary code
>> =20
>>> execution
>>> =20
>> must be of an uploaded non-malicious payload. Submission of
>> =20
>>> a
>>> =20
>> malicious payload is grounds for disqualification from this phase of
>> the
>> =20
>>> challenge.
>>> =20
>>=20
>> I) Technologies Covered:
>> - - Microsoft Internet Explorer 7.0
>> -
>> =20
>>> - Microsoft Windows Vista
>>> =20
>>=20
>> II) Working Exploit Challenge Ground
>> =20
>>> Rules:
>>> =20
>> Working exploit code must be for the submitted vulnerability only
>> =20
>>> =AD
>>> =20
>> iDefense will not consider exploit code for existing vulnerabilities
>> or new
>> =20
>>> vulnerabilities submitted by others. iDefense will consider
>>> =20
>> one and only one
>> =20
>>> working exploit for each original vulnerability
>>> =20
>> submitted.
>>=20
>> The minimum award
>> =20
>>> for a working exploit is $2000. In addition to the
>>> =20
>> base award, additional
>> =20
>>> amounts up to $4000 may be awarded based upon:
>>> =20
>> - - Reliability of the
>> =20
>>> exploit
>>> =20
>> - - Quality of the exploit code
>> - - Readability of the exploit
>> =20
>>> code
>>> =20
>> - - Documentation of the exploit code
>>=20
>>=20
>> -----BEGIN PGP
>> =20
>>> SIGNATURE-----
>>> =20
>> Version: GnuPG v1.4.3 (MingW32)
>> Comment: Using GnuPG with
>> =20
>>> Mozilla - http://enigmail.mozdev.org
>>> =20
>>=20
>> =20
>> iD8DBQFFpSHsYcX4JiqFDSgRAl+ZAJwMJaZoJ6zwd4m8qZfviO ZnNNUVrACgpaTU
>> QkO9IXq+PsC6
>> =20
>>> bMKg7j6Dwfw=3D
>>> =20
>> =3DN0am
>> -----END PGP
>> =20
>>> SIGNATURE-----
>>> =20
>>=20
>> _______________________________________________
>> Full-Disclosur
>> =20
>>> e - We believe in it.
>>> =20
>> Charter:
>> =20
>>> http://lists.grok.org.uk/full-disclosure-charter.html
>>> =20
>> Hosted and sponsored by
>> =20
>>> Secunia - http://secunia.com/
>>> =20
>>=20
>>=20
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>=20
>> =20
>=20