It appears someone within Hewlett-Packard is soliciting the sale of zero day exploits. The original e-mail from "toto toto" appears at the bottom showing the message originated from an internal HP address.
Rogue employee? Corporate conspiracy?
Update: "The Black Market Code Industry" by Adam Penenberg explains it.
---------- Forwarded message ---------- From: security curmudgeon (jericho@attrition.org) To: vim@attrition.org Date: Thu, 31 May 2007 08:57:59 +0000 (UTC) Reply-To: Vulnerability Information ManagersSubject: [VIM] 0day to sell (fwd) Notice the X-Originating-IP: forced ~$ whois 192.6.111.74 OrgName: Hewlett-Packard Company OrgID: HP Address: 3000 Hanover Street City: Palo Alto StateProv: CA PostalCode: 94304 Country: US NetRange: 192.6.22.0 - 192.6.142.255 CIDR: 192.6.22.0/23, 192.6.24.0/21, 192.6.32.0/19, 192.6.64.0/18, 192.6.128.0/21, 192.6.136.0/22, 192.6.140.0/23, 192.6.142.0/24 NetName: HP-3 NetHandle: NET-192-6-22-0-1 Parent: NET-192-0-0-0-0 NetType: Direct Allocation NameServer: PALOALTO.AMERICAS.HP.NET NameServer: ATLANTA.AMERICAS.HP.NET Comment: RegDate: Updated: 2003-01-23 RAbuseHandle: NAR-ARIN RAbuseName: Network Abuse Response RAbusePhone: +1-650-857-5120 RAbuseEmail: abuse@hp.com RTechHandle: AI2-ORG-ARIN RTechName: Hewlett Packard Company RTechPhone: +1-800-524-7638 RTechEmail: ipaddr@hp.com OrgTechHandle: HH15-ORG-ARIN OrgTechName: Hewlett-Packard Company OrgTechPhone: +1-800-524-7638 OrgTechEmail: hostmaster@hp.com ---------- Forwarded message ---------- From: toto toto (snacker@linuxmail.org) X-Originating-IP: 192.6.111.74 To: full-disclosure@lists.grok.org.uk Date: Thu, 31 May 2007 16:55:00 +0800 Subject: [Full-disclosure] 0day to sell hi, some 0day to sell : sap, excel, linux and many other (0day vulns and/or exploits too) contact by mail regards, t0t0 t0t0 =