Two For The Price Of One: New Messenger Exploit And A New Way To Get It

free web hosting
Free Web Hosting > Computers & Tech > Search Engines > Yahoo!

Two For The Price Of One: New Messenger Exploit And A New Way To Get It

tansqrx
A new service run by WSLabi (http://www.wslabi.com/wabisabilabi/home.do?) touts itself as the new eBay of vulnerability researchers (http://www.securityfocus.com/brief/542?ref=rss). From many years there has been a battle between security researchers and software publishers over the price or value of an exploit. As a researcher myself I know how many countless hours go into finding and developing material that is useful in making an exploit. I could easily turn it into a full time job. I do it for a hobby but what if someone wants to make it into a full time job? If you were only able to publish two or three really good exploits a year then you will have to get a fairly large price for you labors.

WSLabi makes it possible to ask the highest bidding price for your exploits. It is apparent that this site may encounter legal issues but these questions will have to be answered as this business model turns into a reality.

As a bonus to this story, one of the first exploits on the site is for a Yahoo! Messenger 8.1 vulnerability (ZD-00000005 - Yahoo! Messenger 8.1 remote buffer overflow). Very little information is given for the exploit but from the description it appears to have something to do with the address book. The current asking price starts at 2000 Euros which no one has taken yet. I am interested in seeing what this is but 2000 Euros is a tad bit high for my curiosity. If anyone is interested in creating an office pool for this exploit let me know. I am good for 50 Euros right now.

 

 

 


Reply

Alegis
Interesting, didn't bother to look up yet how this did work. It does sound a bit like extortion or rather black-mail. Sure, QA of said program should be able to figure it out and protect it. If some people want to turn it into a full time job, they have to be prepared, not every job is in the right place or has demand for.

What use will the address book have? Might be something mundane or meaningless, or not relevant at all. I wouldn't waste money on things like that at all - Don't think it's even for use of those with evil intentions. I think your curiosity will get very disappointed.

Reply

Jimmy89
I must agree! I don't think I would want to go spend my money on something like an exploit, that by the time the 'auction' has finished, may have already ben resolved by Yahoo! And how do you know that they are telling the truth, they may just be making it all up!

Reply

tansqrx
The thought of a scam or someone just making it up did run across my mind. I suppose what I would be more afraid of is a previously released exploit disguised as a new one. At any rate I feel that 50 Euros would be an acceptable price to pay for my curiosity.

Reply

Jimmy89
I suppose, but now all you need is another 39 people to share your curiosity so you can have a look at this exploit!

Reply

Jimmy89
I think your post should be more then just 'what?' to get your point across. But for your sake, whats happening is a group of people are trying to auction off exploits to the yahoo messenger program!

Reply

tansqrx
Don’t worry, I completely understand that an exploit was being offered. From what I can tell the exploit was never bought because it is not showing up in the history. I guess 2000 Euro is a little more than anyone is willing to pay for a Messenger exploit.

Reply

Alegis
And even then could have been something like "Doing this and this, you can add the same person twice in your addressbook!".
Don't pay too much of a price for curiosity, for there are many 'secrets',mysteries and things that just are but untold to others in the world tongue.gif

Well another reason for them not selling is their vague description. It doesn't seem of much use to anyone.

Reply


Got an Opinion! Express your Views! (no registration):-
Add your Reply/ Opinion/ Views/ Comments/ Suggestion/ Questions/ Queries etc.
Posts with decent grammar & English will be accepted and please refrain from profanities.
For asking a Question, We recommend you to sign-up (for free) so that you can track the topic easily.

Nature of your Post*: Opinion/ Reply/ Comments
Question/Query
Feedback to us.
       
Name   Email
Title/Question*

(Maximum characters: 10,000)
You have characters left.

Similar Topics

Keywords : price messenger exploit

  1. Yahoo! Messenger Challenge Response Algorithm - (11)
  2. Yahoo! Messenger Power User - (1)
    I just received a very weird message when I logged into Messenger today. It said “Congratulations,
    you are a Power User!” The pop-up was in its separate window similar to the annoying Insider
    and had a Learn More, Choose Your Icon, and No Thanks button (the Learn More button didn’t work).
    After doing a quick Google search
    (http://help.yahoo.com/l/us/yahoo/messenger/messenger9/pwrusr/pwrusr-01.html)
    (http://messenger.yahoo.com/powerusers) I found that this thing does really exist and wasn’t some ad
    pop-up that somehow got past my defenses. Here are a few of the “b...
  3. Yahoo! Messenger Protocol Tutorial - Part 2 - (2)
    Part 2 - History The need for humans to communicate faster and more efficiently has been one of the
    driving forces behind the Internet. Not since the invention of the telephone has communications
    between humans been more readily available. The communication power of the Internet began to take
    shape in its infancy with one of the first Internet applications, email. While the Internet was
    still ARPANET and with only four links, the first email message was sent by Ray Tomlinson in 1971.
    The first message consisted of the text “Testing 1-2-3” and did not contain any of th...
  4. Yahoo! Messenger Talking To Google Talk? - (7)
    While Yahoo! was off fighting Microsoft, they made some deals with Google to put a slightly
    tainted taste into the merger deal. The most notable one was an ad revenue “trial” where Google
    would serve the ads on Yahoo! pages in return for a very favorable share of the profit. Over
    the past week it appears that the trials were very successful and Yahoo! has agreed to a more
    permanent deal with Google that would continue the deal, pending any anti-trust issues. Mixed up in
    this agreement is a paragraph that indicates future interoperability between the two IM...
  5. It Still Looks Like Microsoft Messenger May Still Happen - (9)
    Over the past week the talks of Microsoft buying Yahoo! has not diminished. Recently Slahsdot
    (http://tech.slashdot.org/article.pl?no_d2=1&sid=08/04/07/236215) published a note that points to
    both a Microsoft press release
    (http://www.microsoft.com/Presspass/press/2008/apr08/04-05LetterPR.mspx) and the Yahoo! reply
    (http://yhoo.client.shareholder.com/press/releasedetail.cfm?ReleaseID=303369). The bottom line is
    that Yahoo! hasn’t said no, they just want more money. In my mind the simple fact that
    Microsoft has not backed down after the initial offer means ...
  6. Yahoo! Messenger 9 Beta Preliminary Review - (13)
    I have been using the latest version of Yahoo! Messenger for over two weeks now and I would like
    to give a quick review of it. Overall this is not a major change from what I know as Messenger. As
    it has been said before, this is evolutionary not revolutionary. From what I can see there are no
    new features (at least none that I would use), the user interface (UI) is prettier, and it looks
    like there have been some bug fixes; that’s it. Under the hood there are some things to note.
    The current version of the YSMG protocol with version 8 is 15 and Messenger 9 has...
  7. Hacking Yahoo! Messenger - (12)
    lately i've been reading some way of hacking yahoo messenger. youtube, hacking forums, and etc,
    i've been there to ask and to learn how to hacking it. but i've been wondering every now and
    then while reading and watching those posted videos and scripts, but they are not working. For real,
    is there any way to hack yahoo messenger?...
  8. Latest Yahoo! Vulnerability Appears To Be A Moving Target For Messenger - (2)
    I have been aware of the latest Yahoo! Jukebox and until recently Messenger exploits for about a
    week. Starting on the 3rd of February, three critical vulnerabilities were posted for datagrid.dll
    and mediagrid.dll which are part of the Yahoo! Jukebox offering
    (http://www.securityfocus.com/bid/27578, http://www.securityfocus.com/bid/27579 ,
    http://www.securityfocus.com/bid/27590) . The reason that I waited so long to post this is because
    the details were inconsistent and it didn’t add up to me. The versions of Messenger that were
    listed as vulnerable are abso...
  9. Tapping Yahoo! Messenger Phone Conversations - (4)
    The latest post on the official Yahoo! Messenger blog appears to be out of place to me
    (http://www.ymessengerblog.com/blog/2008/01/04/recording-yahoo-messenger-calls/). It is not part of
    the usual suspects of promising unneeded features or unabashed promotion of Messenger. Instead it
    is a fairly useful commentary on how to record a Messenger phone session using third party
    applications. The Yahoo! Messenger blog references a New York Times article
    (http://www.nytimes.com/2008/01/03/technology/personaltech/03ASKK-002.html?_r=1&oref=slogin) where a
    user asked if...
  10. “discovr” New Friend With Yahoo! Messenger - (2)
    The latest blog post from the Yahoo! Messenger development teams is about Discovr, a proposed
    new way of sharing Messenger contacts. As is stands Messenger is a closed social community. It is
    very hard to discover new buddies unless you start trolling around the chat rooms or have a buddy in
    real life. Discovr is a method to make Messenger more like Facebook or Myspace where everyone knows
    who your friends are. Discovr came from Hack Days, a common occurrence at Yahoo! that
    encourages different departments to throw out new ideas. (To think Yahoo! actuall...
  11. Yahoo! Messenger Author’s New Security Book - (0)
    There’s not much meat or new content in this post but I did find it rather humorous. Richard Sinn
    is apparently the software security engineer for Yahoo! Messenger and he now has a new book out
    entitled Software Security Technologies: A Progammatic Approach
    (http://blog.messenger.yahoo.com/blog/2007/10/23/kudos-for-the-team/)(http://www.amazon.com/dp/14283
    1945X?tag=open0f-20&camp=14573&creative=327641&linkCode=as1&creativeASIN=142831945X&adid=1435SV1WH79
    S425NG1ZF&). The price is high for a paperback at $87.95 USD but I may read it once the price
    drops or ther...
  12. Minor Updates To Yahoo! Messenger Web - (1)
    The Yahoo! Messenger development team announced that there have been a few minor upgrades to the
    web version of Yahoo! Messenger
    (http://blog.messenger.yahoo.com/blog/2007/09/24/yahoo-messenger-for-the-web-new-release/). From
    what I can see nothing major has been added except for SMS to mobile users and a few new languages
    for India. Apparently the web version of Messenger has taken off in India as nine new languages are
    added for that region. You add the support for the biggest demand....
  13. Messenger Mail Bug? - (2)
    Over the past few days (It is September 23, 2007 now) I have noticed what appears to be a bug in
    Yahoo! Messenger concerning unread mail. No matter if there are unread messages or not,
    Messenger always reports new mail. I have even gone through the trouble of deleting EVERYTHING from
    my mail account and it still pops up. The same behavior happens on Yahelite and Pidgen so it is a
    server side bug. Yahoo! has been upgrading their server so I would expect that this is a side
    effect of some of the upgrades. Of course this could be confined to me so let me know i...
  14. The Yahoo! Messenger Zero-day For The Month Of August - (1)
    Yahoo! Messenger is once again in the news for all the wrong reasons. This time it is a heap
    overflow in the webcam component. The news was apparently first exposed my McAfee in a blog post at
    http://www.avertlabs.com/research/blog/ind...enger-zero-day/ . A second post at
    http://www.avertlabs.com/research/blog/ind...er-webcam-0day/ goes into more detail explaining that
    you shouldn’t accept unknown webcam invites and to possibly firewall port 5100. Security Focus has
    also issued an alert at http://www.securityfocus.com/bid/25330/info but they only classify is...
  15. New Yahoo! Web Messenger - (12)
    Today Yahoo! announced a whole new way to communicate using Messenger. It’s the “all-new
    Web-based Yahoo! Instant Messenger.” Ohh wait a minute, wasn’t there already a web version of
    Yahoo! Messenger? Despite the fact that the official press release
    (http://yodel.yahoo.com/2007/05/02/yahoo-messenger-hold-the-download) makes this out to be something
    completely new, a web version of Messenger has been around for years. I of course will be the first
    to admit that the old version was so bad that I would like to forget about it too. With the bad
    taste of my p...
  16. Yahoo! Messenger Through Web - To be? Or not to be?!~ (6)
    Hello guys, Glad to find here to ask my question, Iam came from here via google. I'm , for many
    weeks, seeking for a solution that give me ability for connecting , sending and reciving, PM's
    to Yahoo Messenger through web protocol I am proff in php, and now seeking for an easy way , not of
    cource socket programming that is hard to implement and buggy , also not every where supported, to
    establishing sessions and managing them through HTTP/1.1 , then I will write an application for i.e
    auto responding, saving history on web, forwarding,managing and etc... i need ...
  17. New Yahoo! Messenger Protocol Changes? - (4)
    I first picked this up on Big Blue Ball in their newsletter
    (http://www.bigblueball.com/forums/yahoo-messenger-news/39852-yahoo-drop-support-y-messenger-7-5-apr
    il-2nd.html). QUOTE As of April 2nd, 2007, we will no longer offer customer support for
    Yahoo! Messenger 7.0/7.5. We recommend that you upgrade to the latest version of Yahoo!
    Messenger. We will keep these help pages available online should you continue to use this version
    and have basic questions that these pages can answer. The administrators of Big Blue Ball
    speculate that this may mean anoth...
  18. Yahoo! Messenger Plugin Sdk - (3)
    I read this morning at theunofficialyahooweblog
    (http://yahoo.weblogsinc.com/2006/06/19/yahoo-opens-up-messenger-to-3rd-party-plug-ins/) that
    Yahoo! has just released a SDK for a plugin engine that will reside in the next version of
    Messenger. I can’t wait to dig into this seemingly juicy morsel of Yahoo! fun. I’m not sure
    what all one can do with the SDK yet but I will be sure to report what I find. The SDK can be found
    at http://developer.yahoo.com/ . A list of already published plugins can be found at
    http://us.gallery.yahoo.com/messenger . Does anyone ...
  19. Messenger Stealth Settings Bug? - (2)
    I have been having problems with my stealth setting for about a week now. Apparently when I have
    all users set to invisible it works fine. Also when I go available everything appears to work fine.
    The problems is when I set a custom message all of a sudden the users that I have individually set
    to offline can see me. I have not been able to reproduce the results myself but it is starting to
    become a problem as people that I would rather not talk to IM me now. Anyone else run into this?
    Is this another bug?...
  20. Yahoo! Messenger Protocol Tutorial - Part 7 - (0)
    Yahoo! Protocol: Part 7 - Yahoo! Packet Structure All Yahoo! communications use TCP
    over IP communication and the Yahoo! data resides in the data field of the TCP packet as shown
    in Figure 13. Figure 13 - Yahoo! Messenger Packet Yahoo! extends the common TCP/IP
    convention of using headers by creating its own application level header format. A Yahoo!
    header is 20 bytes long and is identified by the first 4 bytes being “YMSG.” The Yahoo! header
    also includes the YMSG version, message length, service type, status, and session ID. F...
  21. Yahoo! Messenger Protocol Tutorial - Part 6 - (0)
    Yahoo! Protocol: Part 6 - Money and Closed Protocols Even with all the bells and whistles of
    Yahoo! Messenger, Messenger still follows the same basic communications architecture as most
    other instant messengers. Yahoo! is based on a central server structure. First a client,
    Yahoo! Messenger logs onto a Yahoo! server using a username and password. The server
    authenticates the request and either allows or denies access to services. From this point most
    messages sent to other users are buffered through the server. After a successful login the clie...
  22. Yahoo! Messenger Protocol Tutorial - Part 5 - (0)
    Yahoo! Protocol: Part 5 - Disclaimer and Legal Upon becoming a member of the Yahoo!
    community, a user agrees to follow the Yahoo! Terms of Service (TOS) . According to the TOS,
    when a user registers, he is obligated to provide completely trueful answers to any questions posed
    by Yahoo! and update any information if it changes. Section 3a, b states the following:
    QUOTE You also agree to: (a) provide true, accurate, current and complete information about
    yourself as prompted by the Service's registration form (the "Registration Data") and (B) ...
  23. Yahoo! Messenger Protocol Tutorial - Part 4 - (0)
    As with any basic instant messaging service, Yahoo! Messenger offers several basic functions.
    In general, an instant messenger offers conversations between two users in real time. As a rule,
    both users will see the conversation line by line as it is typed. Although not required, instant
    messengers usually offer the ability to show away messages, reside in the system tray until needed,
    and offer a user buddy list . In addition to these basic services, the latest version of
    Yahoo! Messenger also offers more advanced features. Although not unique, these servic...
  24. Yahoo! Messenger Protocol Tutorial - Part 3 - (0)
    Yahoo! started its life as “Jerry and David’s Guide to the World Wide Web” in January of 1994.
    Its creators David Filo and Jerry Yang, started Yahoo! as a way to track their personal
    interests. As word spread of this new effective search engine, resources were soon strained.
    Moving from Stanford University to Netscape facilities, and finally to its own headquarters,
    Yahoo! has become one of the largest Internet names in history. At the end of the day Yahoo!
    is still a business and like all businesses, Yahoo! has to make a profit and adhere to a bus...
  25. Yahoo Messenger 7.0 - (10)
    Yahoo! recently released the official Yahoo! Messenger 7.0. http://messenger.yahoo.com/
    This is the official version and adds some new functionality to the previous Messenger. QUOTE
    Free Worldwide PC-to-PC Calls Drag-and-Drop Photos Improved File Sharing I know that it has not
    been out that long but i was wondering if anyone else has tried it. I have used it for the past
    couple of days and I think it is an improvment, small improvment, yet at least a step in the foward
    direction. The most advanced feature that I have tried was to send a file which ...
  26. Yahoo! Messenger Protocol Tutorial - Part 1 - (0)
    One of the security passions that I have maintained over the past few years is the one with
    Yahoo! Messenger. In recent months Yahoo! Messenger has seen a decline in users due to some
    new policies. Although not as strong as perhaps a year ago, it is still very important to keep a
    watch on Yahoo! Messenger from a security point of view. Messenger, just like may of the
    programs we use, open a door out to the Internet. With each new door comes a unique set of security
    concerns. Perhaps the biggest reason to keep an eye on Yahoo! Messenger is because the...
  27. New Tools And A New Protocol For Messenger - (0)
    Way back when I had Messenger 6.0 I came across a fairly unique add-on to Yahoo! Messenger that
    added the "join user in chat" function that was taken away in the migration from 5.0 to 6.0. The
    program simply consisted of a file that replaced a Yahoo! DLL and re-enabled the join user in
    chat function. Once I upgraded to 7.0 the program of course did not work and I started my search for
    a replacment. At long last I have found it and not only does it add the join user in chat, it also
    adds view webcam and much more that has been missing since the days of 5.0. The ad...



Looking for price, messenger, exploit

*RANDOM STUFF*





*SIMILAR VIDEOS*
Searching Video's for price, messenger, exploit
advertisement




Two For The Price Of One: New Messenger Exploit And A New Way To Get It



 

 

 

 

ADD REPLY / Got an Opinion! a humble request :-) RAPID SEARCH! Free Hosting [X]
Express your Opinions, Thoughts or Contribute your information that might help someone here.
Ask your Doubts & Queries to get answers.. "Together, We enlight each other!"
Register FREE for AD-FREE forum, Create your own topics, Ask Questions, track topics, setup subscriptions & notifications and Get a Free Website w/ Email and FTP.
500MB Space *No Ads*, CPanel, FTP, PHP, MySQL, EMails - 100% FREE