Hacker News Reader

Comment by zabuni | Hacker News Reader

Worse than that. Apparently,Tavis emailed the exploit to Symantec in a password protected zip file. He included the password in the body of the email. The email server, running Symantec, grabbed the password out of the email, decrypted the zip file, and upon reading the exploit code, crashed itself.

View on HN

Seriously? That's incredible. I'm not sure if I should be impressed that doing so worked, or saddened by the fact that it ACTUALLY WORKED...

It's hilariously ironic. They're in the business of scanning things which smart people want them not to. How does someone send them something they really shouldn't scan?

I very much started reading your post as a comedic sci-fi ending to the story.. but now I am actually not sure. It would be quite creative to think of that scenario! Did this happen?

I'm afraid this did actually happen[1].

[1]: https://bugs.chromium.org/p/project-zero/issues/detail?id=82...

I do not see any indication in the link you posted. Am I missing something?

> I think Symantec's mail server guessed the password "infected" and crashed (this password is commonly used among antivirus vendors to exchange samples), because they asked if they had missed a report I sent.

This is just an assumption

At least they eat their own dog food.

At the end of the day, we all pivot back to our own solutions when it appears we're almost out of runway.

That's a hell of a proof-of-concept.

It wasn't intentional. This was alluded to in Tavis's previous exploit.

But that being said, it's hilarious.

Nice to see that even security researchers can't be bothered to PGP encrypt their messages then.

Why should they? Signing, maybe; encrypting, superfluous and risky in this context (if the other party won't accept or read encrypted mail).

Perhaps because they are discussing critical system vulnerabilities, some of which would be disastrous if they got into the 'wrong' hands before they were patched?

And, from Symantec's own page: Symantec strongly recommends using encrypted email for reporting vulnerability information

Reply on news.ycombinator.com