15 ms·

"Here is the alpc bug as 0day: https://github.com/SandboxEscaper/randomrepo/blob/master/PoC-LPE.rar https://github.com/SandboxEscaper/randomrepo/blob/master/PoC

"Here is the alpc bug as 0day: https://github.com/SandboxEscaper/randomrepo/blob/master/PoC-LPE.rar https://github.com/SandboxEscaper/randomrepo/blob/master/PoC... … I don't fucking care about life anymore. Neither do I ever again want to submit to MSFT anyway. Fuck all of this shit." So is this person upset because Microsoft wouldn't patch the bug? Or that they didn't want to pay for the information? Comments seem to reference Apple pays 25k for this type of info. Can anyone with background give some context here?

qeternity 8y ago
Earlier tweets from this account seem to indicate they believe MS intentionally sabotaged the process so that they could sell the bugs, including to oppressive governments: https://twitter.com/SandboxEscaper/status/1034116189373521920 https://twitter.com/SandboxEscaper/status/103411618937352192... https://twitter.com/SandboxEscaper/status/1034112926045622274 https://twitter.com/SandboxEscaper/status/103411292604562227... EDIT as @dixie_land points out, it appears the author is open to selling indiscriminately.
- dixie_land 8y ago
  I don't know how you reached that conclusion. The tweets read to me that the author is willing to sell to the highest bidder.
  - qeternity 8y ago
    Yeah, fair point. I think the thread that tweet is part of reads better the way you read it. Will edit my comment.
  - deleted 8y ago
    [deleted]
- Rotdhizon 8y ago
  I'm not understanding. Is this lady mad because she wants to get out of bug hunting, so she found a major MSFT bug and tried to sell it, and they patched it and thwarted her attempt at that?
  - ghostbrainalpha 8y ago
    Definitely not that. Microsoft has not patched the issue. That's why its a big deal that she is posting it on Twitter.
- mockingbirdy 8y ago
  Please see https://news.ycombinator.com/item?id=17860480 https://news.ycombinator.com/item?id=17860480 before downvoting. From her website - http://sandboxescaper.blogspot.com http://sandboxescaper.blogspot.com: > I'm also transgender. But my transition so far has been really difficult (social isolation, lack of support.. etc), my voice is still really manly and I don't really pass at all (which probably weirds people out.. so I would rather say it upfront so I don't need to have anxiety about it, I have alot of anxiety issues). I also have not been able to change my name yet, legally its still "Thomas". - - - w.r.t. the 0-day release: Well that's some seriously irresponsible stuff right there. I think she has a tough time (she's transgender and doesn't have support from her peers). It's sad that she hasn't found a way to live a happy life although she clearly has serious skills. I hope she'll be fine. It's just annoying that a lot of users are now at risk, I hope the patches will be installed ASAP.
  - daxorid 8y ago
    Full disclosure is not "irresponsible", and plenty of researchers do it even in the absence of armchair psychoanalysis by the Internet.
    - mockingbirdy 8y ago
      Most of them follow specific timelines for those disclosures which are communicated with the affected vendor.
      - throwawayjava 8y ago
        And also don't follow up a disclosure with an offer to sell exploits to the highest bidder. Is selling an exploit to a foreign government even 100% legal? (Serious question; that seems like the sort of thing that could get one in trouble.)
        LinuxBender 8y ago
        If you sold to a country with standing sanctions, that could be an issue. 0-day's can also be considered munitions in some interpretations of law, though I am not a lawyer nor a weapons dealer.
- samstave 8y ago
  Are you saying that MSFT wanted to be sure to maintain MSFT's prerogative to sell the exploit to oppressive governments? If this is the case, which I can see how it could be, then this is the bigger story for those outside of Tech circles to understand.
- deleted 8y ago
  [deleted]
- exikyut 8y ago
  Both tweets were deleted - but Google still had them cached! \o/ 1st link -> http://archive.is/8xh4z http://archive.is/8xh4z 2nd link -> http://archive.is/KGyCf http://archive.is/KGyCf
berns 8y ago
> I don't want to work in IT security anymore. All the industry bullshit ruined it for me. I can't even motivate myself anymore to bug hunt. But I have no other skills to make money with, I'm so screwed. and > Will sell to people in the eastern hemisphere too. I just want money so I can travel.
- jasonlfunk 8y ago
  It seems that anyone who knows enough to find this level of 0day vulnerability has skills that people would pay for.
  - chelmzy 8y ago
    Yes but not many companies will put up with someone who does this shit.
    - Rotdhizon 8y ago
      I can sympathize with her strife, but she is on the path to seriously burn bridges. I can't imagine many security focused companies would touch her with a 10 foot pole now that she publicly admitted that she is willing to sell a 0day for profit. Sure she is going through a rough time, but even when angry, you have to not say things you regret, especially online. EDIT: Did not realize selling bugs outside of bug bounty programs and related bug programs was a normal thing. Now I know.
      - prolikewh0a 8y ago
        >but she is on the path to seriously burn bridges As a transgender person, this is all that happens in our lives to be honest. It's very tough to have anything but a 'rough time' when the general public views you weirdly, and your family/friends have completely abandoned you.
        Gargeemel 8y ago
        No one is interested in your perverted lifestyle. A majority believe that gender is not a choice.
deleted 8y ago
[deleted]
zdragnar 8y ago
Reading through the author's blog (links found further below) it would seem that on more than one occasion the author didn't receive credit, which presumably makes it harder to find new jobs. The author's blog is also full of anti-social comments, which would sound awfully melodramatic if I didn't have personal experience with depression. Regardless, it is a public expression that she's going to be a fairly toxic person to work with, which is almost certainly working against her in the job hunt.
lima 8y ago
Sounds like she had a frustrating experience while trying to responsibly report it to Microsoft.
- lawnchair_larry 8y ago
  For what it’s worth, even Microsoft famously disavowed the use of the term “responsible” in this context.
strictnein 8y ago
If I recall correctly, she has an "interesting" relationship with MS. Finds lot of stuff, gets really frustrated with their process.
- mintplant 8y ago
  I'm not surprised. For me, the process of reporting to MS has gone: 1) Jump through a surprising number of hoops to set up a Windows 10 Insider channel machine, reproduction on which is required for their security program. 2) Email a write-up and PoCs to their security address. 3) Get back two emails naming a point of contact and dumping a pile of legal agreements they expect me to follow just for reaching out to them. 4) Receive no further contact or indications of progress.
mzs 8y ago
It satisfies a profile that hostile intelligence services take advantage of.

qeternity 8y ago

Earlier tweets from this account seem to indicate they believe MS intentionally sabotaged the process so that they could sell the bugs, including to oppressive governments: https://twitter.com/SandboxEscaper/status/1034116189373521920 https://twitter.com/SandboxEscaper/status/103411618937352192... https://twitter.com/SandboxEscaper/status/1034112926045622274 https://twitter.com/SandboxEscaper/status/103411292604562227... EDIT as @dixie_land points out, it appears the author is open to selling indiscriminately.

dixie_land 8y ago
I don't know how you reached that conclusion. The tweets read to me that the author is willing to sell to the highest bidder.
- qeternity 8y ago
  Yeah, fair point. I think the thread that tweet is part of reads better the way you read it. Will edit my comment.
- deleted 8y ago
  [deleted]
Rotdhizon 8y ago
I'm not understanding. Is this lady mad because she wants to get out of bug hunting, so she found a major MSFT bug and tried to sell it, and they patched it and thwarted her attempt at that?
- ghostbrainalpha 8y ago
  Definitely not that. Microsoft has not patched the issue. That's why its a big deal that she is posting it on Twitter.
mockingbirdy 8y ago
Please see https://news.ycombinator.com/item?id=17860480 https://news.ycombinator.com/item?id=17860480 before downvoting. From her website - http://sandboxescaper.blogspot.com http://sandboxescaper.blogspot.com: > I'm also transgender. But my transition so far has been really difficult (social isolation, lack of support.. etc), my voice is still really manly and I don't really pass at all (which probably weirds people out.. so I would rather say it upfront so I don't need to have anxiety about it, I have alot of anxiety issues). I also have not been able to change my name yet, legally its still "Thomas". - - - w.r.t. the 0-day release: Well that's some seriously irresponsible stuff right there. I think she has a tough time (she's transgender and doesn't have support from her peers). It's sad that she hasn't found a way to live a happy life although she clearly has serious skills. I hope she'll be fine. It's just annoying that a lot of users are now at risk, I hope the patches will be installed ASAP.
- daxorid 8y ago
  Full disclosure is not "irresponsible", and plenty of researchers do it even in the absence of armchair psychoanalysis by the Internet.
  - mockingbirdy 8y ago
    Most of them follow specific timelines for those disclosures which are communicated with the affected vendor.
    - throwawayjava 8y ago
      And also don't follow up a disclosure with an offer to sell exploits to the highest bidder. Is selling an exploit to a foreign government even 100% legal? (Serious question; that seems like the sort of thing that could get one in trouble.)
      - LinuxBender 8y ago
        If you sold to a country with standing sanctions, that could be an issue. 0-day's can also be considered munitions in some interpretations of law, though I am not a lawyer nor a weapons dealer.
samstave 8y ago
Are you saying that MSFT wanted to be sure to maintain MSFT's prerogative to sell the exploit to oppressive governments? If this is the case, which I can see how it could be, then this is the bigger story for those outside of Tech circles to understand.
deleted 8y ago
[deleted]
exikyut 8y ago
Both tweets were deleted - but Google still had them cached! \o/ 1st link -> http://archive.is/8xh4z http://archive.is/8xh4z 2nd link -> http://archive.is/KGyCf http://archive.is/KGyCf

berns 8y ago

> I don't want to work in IT security anymore. All the industry bullshit ruined it for me. I can't even motivate myself anymore to bug hunt. But I have no other skills to make money with, I'm so screwed. and > Will sell to people in the eastern hemisphere too. I just want money so I can travel.

jasonlfunk 8y ago
It seems that anyone who knows enough to find this level of 0day vulnerability has skills that people would pay for.
- chelmzy 8y ago
  Yes but not many companies will put up with someone who does this shit.
  - Rotdhizon 8y ago
    I can sympathize with her strife, but she is on the path to seriously burn bridges. I can't imagine many security focused companies would touch her with a 10 foot pole now that she publicly admitted that she is willing to sell a 0day for profit. Sure she is going through a rough time, but even when angry, you have to not say things you regret, especially online. EDIT: Did not realize selling bugs outside of bug bounty programs and related bug programs was a normal thing. Now I know.
    - prolikewh0a 8y ago
      >but she is on the path to seriously burn bridges As a transgender person, this is all that happens in our lives to be honest. It's very tough to have anything but a 'rough time' when the general public views you weirdly, and your family/friends have completely abandoned you.
      - Gargeemel 8y ago
        No one is interested in your perverted lifestyle. A majority believe that gender is not a choice.

deleted 8y ago

[deleted]

zdragnar 8y ago

Reading through the author's blog (links found further below) it would seem that on more than one occasion the author didn't receive credit, which presumably makes it harder to find new jobs. The author's blog is also full of anti-social comments, which would sound awfully melodramatic if I didn't have personal experience with depression. Regardless, it is a public expression that she's going to be a fairly toxic person to work with, which is almost certainly working against her in the job hunt.

lima 8y ago

Sounds like she had a frustrating experience while trying to responsibly report it to Microsoft.

lawnchair_larry 8y ago
For what it’s worth, even Microsoft famously disavowed the use of the term “responsible” in this context.

strictnein 8y ago

If I recall correctly, she has an "interesting" relationship with MS. Finds lot of stuff, gets really frustrated with their process.

mintplant 8y ago
I'm not surprised. For me, the process of reporting to MS has gone: 1) Jump through a surprising number of hoops to set up a Windows 10 Insider channel machine, reproduction on which is required for their security program. 2) Email a write-up and PoCs to their security address. 3) Get back two emails naming a point of contact and dumping a pile of legal agreements they expect me to follow just for reaching out to them. 4) Receive no further contact or indications of progress.

mzs 8y ago

It satisfies a profile that hostile intelligence services take advantage of.