如果你是用的是Firefox，并且使用默认的密码保存功能，在登录Gmail的时候，可能会发现有一条把密码保存到ndns01.com的提示。而之前你确定无误的输入了gmail的地址，如通常一般输入用户名密码登录。
此种攻击的方式和效果不详。可能会在历史记录中留下如下记录（不要点击！已经替换连接符号为全角）：
ＨＴＴＰ：／／mail.google.com-
sfmail-dns001account-3dframeuioutmntmp.spvdhtml-template-800064zuzhuzzz-
serverlogin.beij900.ndns01.com／web／gmail／Gmail
该网站在Google中留有如下记录（搜索 site:ndns01.com 即可；不要点击！已经替换连接符号为全角）：
ＨＴＴＰ：／／login.yahoo.com-
sfmail-dns001account-3dframeuioutmntmp.spvdhtml-template-800064zuzhuzzz-
serverlogin.jizhong900.ndns01.com／web／yahoo／Yahoo?url=index
说明其不仅攻击Gmail，起码也攻击过或者试图攻击过yahoo邮箱。
该页面目前是一个500错误页面，结果如下：
HTTP Status 500 -
type Exception report
message
description The server encountered an internal error () that prevented it from fulfilling this request.
exception
java.net.SocketException: Connection reset
java.net.SocketInputStream.read(Unknown Source)
java.io.BufferedInputStream.fill(Unknown Source)
java.io.BufferedInputStream.read1(Unknown Source)
java.io.BufferedInputStream.read(Unknown Source)
sun.net.www.http.ChunkedInputStream.fastRead(Unknown Source)
sun.net.www.http.ChunkedInputStream.read(Unknown Source)
java.io.FilterInputStream.read(Unknown Source)
sun.net.www.protocol.http.HttpURLConnection$HttpInputStream.read(Unknown Source)
sun.nio.cs.StreamDecoder.readBytes(Unknown Source)
sun.nio.cs.StreamDecoder.implRead(Unknown Source)
sun.nio.cs.StreamDecoder.read(Unknown Source)
sun.nio.cs.StreamDecoder.read0(Unknown Source)
sun.nio.cs.StreamDecoder.read(Unknown Source)
java.io.InputStreamReader.read(Unknown Source)
com.run.web.yahoo.Yahoo.getLoginPage(Unknown Source)
com.run.web.yahoo.Yahoo.doGet(Unknown Source)
javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
com.run.filter.Restrict.doFilter(Unknown Source)
note The full stack trace of the root cause is available in the Apache Tomcat/6.0.18 logs.
Apache Tomcat/6.0.18
我们会将此状况通告相关公司。
附该域名2010年7月28日的whois信息：
Domain Name: NDNS01.COM
Registrar: XIN NET TECHNOLOGY CORPORATION
Whois Server: whois.paycenter.com.cn
Referral URL:
http://www.xinnet.com Name Server: NS12.CDNCENTER.COM
Name Server: NS8.CDNCENTER.COM
Status: ok
Updated Date: 04-jul-2010
Creation Date: 31-may-2009
Expiration Date: 31-may-2012
>>> Last update of whois database: Wed, 28 Jul 2010 13:24:05 UTC <<<
Domain Name : ndns01.com
PunnyCode : ndns01.com
Creation Date : 2009-05-31 21:06:58
Updated Date : 2010-07-05 00:28:03
Expiration Date : 2012-05-31 21:06:54
Registrant:
Organization : gu long
Name : gu long
Address : shijiazhuang
City : shijiazhuang
Province/State : hebei
Country : cn
Postal Code : 050043
Administrative Contact:
Name : gu long
Organization : gu long
Address : shijiazhuang
City : shijiazhuang
Province/State : hebei
Country : cn
Postal Code : 050043
Phone Number : 86-031-187935114
Fax : 86-031-187935116
Email :
[email protected] Technical Contact:
Name : gu long
Organization : gu long
Address : shijiazhuang
City : shijiazhuang
Province/State : hebei
Country : cn
Postal Code : 050043
Phone Number : 86-031-187935114
Fax : 86-031-187935116
Email :
[email protected] Billing Contact:
Name : gu long
Organization : gu long
Address : shijiazhuang
City : shijiazhuang
Province/State : hebei
Country : cn
Postal Code : 050043
Phone Number : 86-031-187935114
Fax : 86-031-187935116
Email :
[email protected] [HiChina Format]
Domain Name ..................... ndns01.com
Registrant Name ................. gu long
Registrant Organization ......... gu long
Registrant Address .............. shijiazhuang
Registrant City ................. shijiazhuang
Registrant Province/State ....... hebei
Registrant Postal Code .......... 050043
Registrant Country Code ......... cn
Administrative Name ............. gu long
Administrative Organization ..... gu long
Administrative Address .......... shijiazhuang
Administrative City ............. shijiazhuang
Administrative Province/State ... hebei
Administrative Postal Code ...... 050043
Administrative Country Code ..... cn
Administrative Phone Number ..... 86-031-187935114
Administrative Fax .............. 86-031-187935116
Administrative Email ............
[email protected] Billing Name .................... gu long
Billing Organization ............ gu long
Billing Address ................. shijiazhuang
Billing City .................... shijiazhuang
Billing Province/State .......... hebei
Billing Postal Code ............. 050043
Billing Country Code ............ cn
Billing Phone Number ............ 86-031-187935114
Billing Fax ..................... 86-031-187935116
Billing Email ...................
[email protected] Technical Name .................. gu long
Technical Organization .......... gu long
Technical Address ............... shijiazhuang
Technical City .................. shijiazhuang
Technical Province/State ........ hebei
Technical Postal Code ........... 050043
Technical Country Code .......... cn
Technical Phone Number .......... 86-031-187935114
Technical Fax ................... 86-031-187935116
Technical Email .................
[email protected] 更新1：
看来表达得过于谨慎和含蓄了：
1、这个攻击与保存密码之类的无关；
2、虽然没有证据，但是很有可能是类似于http挟持一类的，可能与客户端没有关系；
3、据监测，该攻击可能采用了随机抽样发动的方式，所以短时间小样本是无法重现的。
如果以上成立，没有人是安全的。
更新2：
看了一下，这次和报告里面的不太一样，不是钓鱼或者链接的方式。是在浏览器中直接输入gmail.com然后登录，登录后也是正常的gmail内容和地址。
由于https一般认为是安全的，没有透明的伪装方法，所以，最有可能的是在"
http://gmail.com"被google转向为https的过程中出现的。
这里有个
不负责任的推论：如果直接访问https的地址，应该就没有问题了。
