RE: 0day: PDF pwns Windows

For the record, the original term "O-Day" was coined by a dyslexic
security engineer who listened to too much Harry Belafonte while working
all night on a drink of rum. It's true. Really.


-----Original Message-----
From: Roland Kuhn [mailto:rkuhn@xxxxxxxxxxxxxxxxxxxxxxxxx]
Sent: Tuesday, September 25, 2007 10:58 AM
To: Lamont Granquist
Cc: Chad Perrin; Crispin Cowan; Casper.Dik@xxxxxxx; Gadi Evron; pdp
(architect); bugtraq@xxxxxxxxxxxxxxxxx; full-
Subject: Re: 0day: PDF pwns Windows

On 25 Sep 2007, at 00:57, Lamont Granquist wrote:

The exploit is not made public by its use. The exploit is not even
made public by (back-channel) sharing amongst the hacker/cracker
community. The exploit is only made public if detected or the
vulnerability is disclosed. Until detected/disclosed the hacker/
cracker can use their 31337 0day spl01tz to break into whichever
vulnerable machines they like. 0day exploits are valuable because
opposition is ignorant of them.

Posting exploits to BUGTRAQ, however, inherently makes them not

And my ignorant self thought until this thread that the "0" in the
referred to the number of days of head start granted to the vendor.
Silly me. Because that would make all vulnerabilities published
prior warning to the vendor a "0day"...

Roland (who seems to remember that this was once the meaning of this