[Full-disclosure] Any one saw these attacks before?

2007-01-30 Thread Jianqiang Xin
Did anyone see web attack like this? If yes, is the attack generated by worm, spamware, or virus? Thanks. It is one packet with too many headers: The headers are as following: Headers Host : www.microsoft.com Host : www.microsoft.com Host : www.microsoft.com Host : www.microsoft.com Host

[Full-disclosure] Is there a way to trace back Tor user

2006-06-12 Thread Jianqiang Xin
Regarding to recent debate about the use of Tor. Just wondering if it is practical to trace back the user if he is using Tor to hide his origin. As far as I know, there were several approaches using timing correlation to trace back TCP connections. It seems that the technique is there but the

[Full-disclosure] help about tool to control x window client (xterm) script-like way

2006-03-24 Thread Jianqiang Xin
hi, In our research, we need to generate some X traffic through network. The current approach is let human actor sit manipulate a xterm window to type keys, move mouse, resize window. Is there any tool that can automatically do this? The ideal one might trigger key press, button press, window

Re: [Full-disclosure] strange domain name in phishing email

2006-03-15 Thread Jianqiang Xin
I tried the same address using nslookup of windows and linux. The linux nslookup and host generate an error message: ** server can't find 1406379699: NXDOMAIN. nslookup of Windows translate the number to a domain name. It seems that it works different for different operating system. Have a good

[Full-disclosure] strange domain name in phishing email

2006-03-11 Thread Jianqiang Xin
hi, I received several phishing emails. One interesting thing is the link to phishing website has the link: http://1406379699/dbweb/ws/ebay/index.htm If you click it, it goes to a fake ebay server. The DNS result shows: 1406379699 Server: Address: Name: ip-166-179.sn2.eutelia.it Address: