Gray Hat Hacking, The Ethical Hacker’s Handbook, Third Edition
66
When Company Researchers Research Resolution/
Making Threat Topic Status
2003-09-30 Blackboard Billy Hoffman and Blackboard issued Confidential
Transaction System Virgil Griffith C&D to Interz0ne agreement reached
conference, filed between Hoffman,
complaint against Griffith, and
students Blackboard.
2002-07-30 Hewlett-Packard SNOsoft Tru64 Unix OS Vendor/researcher
Development vulnerability, agree on future
Company, L.P. (HP) DMCA-based timeline; additional
threat Tru64 vulnerabilities
published; HP asks
Neohapsis for
OpenSSL exploit
code shortly after.
2001-07-16 Adobe Systems Dmitry Sklyarov & Adobe eBook ElcomSoft found
Incorporated ElcomSoft AEBPR Bypass not guilty.
2001-04-23 Secure Digital Music Ed Felten Four watermark Research published
Initiative (SDMI), protection at USENIX 2001.
Recording Industry schemes bypass,
Association of DMCA-based
America (RIAA) and threat
Verance Corporation
2000-08-17 Motion Picture 2600: The Hacker DVD encryption DeCSS ruled “not a
Association of Quarterly breaking software trade secret.”
America (MPAA) & (DeCSS)
DVD Copy Control
Association (DVD
CCA)
C&D stands for cease and desist.
Table 3-1 Vulnerability Disclosures and Resolutions (continued)
References
Full Disclosure of Software Vulnerabilities a “Damned Good Idea,” January 9,
2007 (Bruce Schneier) www.csoonline.com/article/216205/Schneier_Full_
Disclosure_of_Security_Vulnerabilities_a_Damned_Good_Idea_
IBM Internet Security Systems Vulnerability Disclosure Guidelines (X-Force team)
ftp://ftp.software.ibm.com/common/ssi/sa/wh/n/sel03008usen/SEL03008USEN.PDF
Mozilla Security Bug Bounty Program
http://www.mozilla.org/security/bug-bounty.html
No More Free Bugs (Charlie Miller, Alex Sotirov, and Dino Dai Zovi)
www.nomorefreebugs.com
Software Vulnerability Disclosure: The Chilling Effect, January 1, 2007
(Scott Berinato) www.csoonline.com/article/221113/Software_Vulnerability_
Disclosure_The_Chilling_Effect?page=1
The Vulnerability Disclosure Game: Are We More Secure?, March 1, 2008 (Marcus
J. Ranum) www.csoonline.com/article/440110/The_Vulnerability_Disclosure_
Game_Are_We_More_Secure_?CID=28073