::电驴基地:: - Powered by Discuz! Board

如果你是用的是Firefox，并且使用默认的密码保存功能，在登录Gmail的时候，可能会发现有一条把密码保存到ndns01.com的提示。而之前你确定无误的输入了gmail的地址，如通常一般输入用户名密码登录。

此种攻击的方式和效果不详。可能会在历史记录中留下如下记录（不要点击！已经替换连接符号为全角）：
ＨＴＴＰ：／／mail.google.com-
sfmail-dns001account-3dframeuioutmntmp.spvdhtml-template-800064zuzhuzzz-
serverlogin.beij900.ndns01.com／web／gmail／Gmail

该网站在Google中留有如下记录（搜索 site:ndns01.com 即可；不要点击！已经替换连接符号为全角）：
ＨＴＴＰ：／／login.yahoo.com-
sfmail-dns001account-3dframeuioutmntmp.spvdhtml-template-800064zuzhuzzz-
serverlogin.jizhong900.ndns01.com／web／yahoo／Yahoo?url=index
说明其不仅攻击Gmail，起码也攻击过或者试图攻击过yahoo邮箱。
该页面目前是一个500错误页面，结果如下：

引用

HTTP Status 500 -

type Exception report

message

description The server encountered an internal error () that prevented it from fulfilling this request.

exception

java.net.SocketException: Connection reset
   java.net.SocketInputStream.read(Unknown Source)
   java.io.BufferedInputStream.fill(Unknown Source)
   java.io.BufferedInputStream.read1(Unknown Source)
   java.io.BufferedInputStream.read(Unknown Source)
   sun.net.www.http.ChunkedInputStream.fastRead(Unknown Source)
   sun.net.www.http.ChunkedInputStream.read(Unknown Source)
   java.io.FilterInputStream.read(Unknown Source)
   sun.net.www.protocol.http.HttpURLConnection$HttpInputStream.read(Unknown Source)
   sun.nio.cs.StreamDecoder.readBytes(Unknown Source)
   sun.nio.cs.StreamDecoder.implRead(Unknown Source)
   sun.nio.cs.StreamDecoder.read(Unknown Source)
   sun.nio.cs.StreamDecoder.read0(Unknown Source)
   sun.nio.cs.StreamDecoder.read(Unknown Source)
   java.io.InputStreamReader.read(Unknown Source)
   com.run.web.yahoo.Yahoo.getLoginPage(Unknown Source)
   com.run.web.yahoo.Yahoo.doGet(Unknown Source)
   javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
   javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   com.run.filter.Restrict.doFilter(Unknown Source)
note The full stack trace of the root cause is available in the Apache Tomcat/6.0.18 logs.

Apache Tomcat/6.0.18

我们会将此状况通告相关公司。

附该域名2010年7月28日的whois信息：

引用

Domain Name: NDNS01.COM
Registrar: XIN NET TECHNOLOGY CORPORATION
Whois Server: whois.paycenter.com.cn
Referral URL: http://www.xinnet.com
Name Server: NS12.CDNCENTER.COM
Name Server: NS8.CDNCENTER.COM
Status: ok
Updated Date: 04-jul-2010
Creation Date: 31-may-2009
Expiration Date: 31-may-2012

>>> Last update of whois database: Wed, 28 Jul 2010 13:24:05 UTC <<<

Domain Name : ndns01.com
PunnyCode : ndns01.com
Creation Date : 2009-05-31 21:06:58
Updated Date : 2010-07-05 00:28:03
Expiration Date : 2012-05-31 21:06:54

Registrant:
Organization : gu long
Name : gu long
Address : shijiazhuang
City : shijiazhuang
Province/State : hebei
Country : cn
Postal Code : 050043

Administrative Contact:
Name : gu long
Organization : gu long
Address : shijiazhuang
City : shijiazhuang
Province/State : hebei
Country : cn
Postal Code : 050043
Phone Number : 86-031-187935114
Fax : 86-031-187935116
Email : [email protected]

Technical Contact:
Name : gu long
Organization : gu long
Address : shijiazhuang
City : shijiazhuang
Province/State : hebei
Country : cn
Postal Code : 050043
Phone Number : 86-031-187935114
Fax : 86-031-187935116
Email : [email protected]

Billing Contact:
Name : gu long
Organization : gu long
Address : shijiazhuang
City : shijiazhuang
Province/State : hebei
Country : cn
Postal Code : 050043
Phone Number : 86-031-187935114
Fax : 86-031-187935116
Email : [email protected]

[HiChina Format]
Domain Name ..................... ndns01.com
Registrant Name ................. gu long
Registrant Organization ......... gu long
Registrant Address .............. shijiazhuang
Registrant City ................. shijiazhuang
Registrant Province/State ....... hebei
Registrant Postal Code .......... 050043
Registrant Country Code ......... cn
Administrative Name ............. gu long
Administrative Organization ..... gu long
Administrative Address .......... shijiazhuang
Administrative City ............. shijiazhuang
Administrative Province/State ... hebei
Administrative Postal Code ...... 050043
Administrative Country Code ..... cn
Administrative Phone Number ..... 86-031-187935114
Administrative Fax .............. 86-031-187935116
Administrative Email ............ [email protected]
Billing Name .................... gu long
Billing Organization ............ gu long
Billing Address ................. shijiazhuang
Billing City .................... shijiazhuang
Billing Province/State .......... hebei
Billing Postal Code ............. 050043
Billing Country Code ............ cn
Billing Phone Number ............ 86-031-187935114
Billing Fax ..................... 86-031-187935116
Billing Email ................... [email protected]
Technical Name .................. gu long
Technical Organization .......... gu long
Technical Address ............... shijiazhuang
Technical City .................. shijiazhuang
Technical Province/State ........ hebei
Technical Postal Code ........... 050043
Technical Country Code .......... cn
Technical Phone Number .......... 86-031-187935114
Technical Fax ................... 86-031-187935116
Technical Email ................. [email protected]

更新1：

看来表达得过于谨慎和含蓄了：

1、这个攻击与保存密码之类的无关；

2、虽然没有证据，但是很有可能是类似于http挟持一类的，可能与客户端没有关系；

3、据监测，该攻击可能采用了随机抽样发动的方式，所以短时间小样本是无法重现的。

如果以上成立，没有人是安全的。

更新2：

引用自: 木华于七月 28, 2010, 11:06:49 下午

可以查看一下这一份报告，3月份的时候赛门铁克发过预警
http://www.docin.com/p-54731979.html

看了一下，这次和报告里面的不太一样，不是钓鱼或者链接的方式。是在浏览器中直接输入gmail.com然后登录，登录后也是正常的gmail内容和地址。

由于https一般认为是安全的，没有透明的伪装方法，所以，最有可能的是在"http://gmail.com"被google转向为https的过程中出现的。
这里有个不负责任的推论：如果直接访问https的地址，应该就没有问题了。

14	一般分类 / CMDed主论坛 / 警告：请大家检查自己的浏览历史中有没有ndns01.com的记录	于: 七月 28, 2010, 09:38:36 下午
如果你是用的是Firefox，并且使用默认的密码保存功能，在登录Gmail的时候，可能会发现有一条把密码保存到ndns01.com的提示。而之前你确定无误的输入了gmail的地址，如通常一般输入用户名密码登录。此种攻击的方式和效果不详。可能会在历史记录中留下如下记录（不要点击！已经替换连接符号为全角）：ＨＴＴＰ：／／mail.google.com- sfmail-dns001account-3dframeuioutmntmp.spvdhtml-template-800064zuzhuzzz- serverlogin.beij900.ndns01.com／web／gmail／Gmail 该网站在Google中留有如下记录（搜索 site:ndns01.com 即可；不要点击！已经替换连接符号为全角）：ＨＴＴＰ：／／login.yahoo.com- sfmail-dns001account-3dframeuioutmntmp.spvdhtml-template-800064zuzhuzzz- serverlogin.jizhong900.ndns01.com／web／yahoo／Yahoo?url=index 说明其不仅攻击Gmail，起码也攻击过或者试图攻击过yahoo邮箱。该页面目前是一个500错误页面，结果如下：引用 HTTP Status 500 - type Exception report message description The server encountered an internal error () that prevented it from fulfilling this request. exception java.net.SocketException: Connection reset java.net.SocketInputStream.read(Unknown Source) java.io.BufferedInputStream.fill(Unknown Source) java.io.BufferedInputStream.read1(Unknown Source) java.io.BufferedInputStream.read(Unknown Source) sun.net.www.http.ChunkedInputStream.fastRead(Unknown Source) sun.net.www.http.ChunkedInputStream.read(Unknown Source) java.io.FilterInputStream.read(Unknown Source) sun.net.www.protocol.http.HttpURLConnection$HttpInputStream.read(Unknown Source) sun.nio.cs.StreamDecoder.readBytes(Unknown Source) sun.nio.cs.StreamDecoder.implRead(Unknown Source) sun.nio.cs.StreamDecoder.read(Unknown Source) sun.nio.cs.StreamDecoder.read0(Unknown Source) sun.nio.cs.StreamDecoder.read(Unknown Source) java.io.InputStreamReader.read(Unknown Source) com.run.web.yahoo.Yahoo.getLoginPage(Unknown Source) com.run.web.yahoo.Yahoo.doGet(Unknown Source) javax.servlet.http.HttpServlet.service(HttpServlet.java:617) javax.servlet.http.HttpServlet.service(HttpServlet.java:717) com.run.filter.Restrict.doFilter(Unknown Source) note The full stack trace of the root cause is available in the Apache Tomcat/6.0.18 logs. Apache Tomcat/6.0.18 我们会将此状况通告相关公司。附该域名2010年7月28日的whois信息：引用 Domain Name: NDNS01.COM Registrar: XIN NET TECHNOLOGY CORPORATION Whois Server: whois.paycenter.com.cn Referral URL: http://www.xinnet.com Name Server: NS12.CDNCENTER.COM Name Server: NS8.CDNCENTER.COM Status: ok Updated Date: 04-jul-2010 Creation Date: 31-may-2009 Expiration Date: 31-may-2012 >>> Last update of whois database: Wed, 28 Jul 2010 13:24:05 UTC <<< Domain Name : ndns01.com PunnyCode : ndns01.com Creation Date : 2009-05-31 21:06:58 Updated Date : 2010-07-05 00:28:03 Expiration Date : 2012-05-31 21:06:54 Registrant: Organization : gu long Name : gu long Address : shijiazhuang City : shijiazhuang Province/State : hebei Country : cn Postal Code : 050043 Administrative Contact: Name : gu long Organization : gu long Address : shijiazhuang City : shijiazhuang Province/State : hebei Country : cn Postal Code : 050043 Phone Number : 86-031-187935114 Fax : 86-031-187935116 Email : [email protected] Technical Contact: Name : gu long Organization : gu long Address : shijiazhuang City : shijiazhuang Province/State : hebei Country : cn Postal Code : 050043 Phone Number : 86-031-187935114 Fax : 86-031-187935116 Email : [email protected] Billing Contact: Name : gu long Organization : gu long Address : shijiazhuang City : shijiazhuang Province/State : hebei Country : cn Postal Code : 050043 Phone Number : 86-031-187935114 Fax : 86-031-187935116 Email : [email protected] [HiChina Format] Domain Name ..................... ndns01.com Registrant Name ................. gu long Registrant Organization ......... gu long Registrant Address .............. shijiazhuang Registrant City ................. shijiazhuang Registrant Province/State ....... hebei Registrant Postal Code .......... 050043 Registrant Country Code ......... cn Administrative Name ............. gu long Administrative Organization ..... gu long Administrative Address .......... shijiazhuang Administrative City ............. shijiazhuang Administrative Province/State ... hebei Administrative Postal Code ...... 050043 Administrative Country Code ..... cn Administrative Phone Number ..... 86-031-187935114 Administrative Fax .............. 86-031-187935116 Administrative Email ............ [email protected] Billing Name .................... gu long Billing Organization ............ gu long Billing Address ................. shijiazhuang Billing City .................... shijiazhuang Billing Province/State .......... hebei Billing Postal Code ............. 050043 Billing Country Code ............ cn Billing Phone Number ............ 86-031-187935114 Billing Fax ..................... 86-031-187935116 Billing Email ................... [email protected] Technical Name .................. gu long Technical Organization .......... gu long Technical Address ............... shijiazhuang Technical City .................. shijiazhuang Technical Province/State ........ hebei Technical Postal Code ........... 050043 Technical Country Code .......... cn Technical Phone Number .......... 86-031-187935114 Technical Fax ................... 86-031-187935116 Technical Email ................. [email protected] 更新1：看来表达得过于谨慎和含蓄了： 1、这个攻击与保存密码之类的无关； 2、虽然没有证据，但是很有可能是类似于http挟持一类的，可能与客户端没有关系； 3、据监测，该攻击可能采用了随机抽样发动的方式，所以短时间小样本是无法重现的。如果以上成立，没有人是安全的。更新2：引用自: 木华于七月 28, 2010, 11:06:49 下午可以查看一下这一份报告，3月份的时候赛门铁克发过预警 http://www.docin.com/p-54731979.html 看了一下，这次和报告里面的不太一样，不是钓鱼或者链接的方式。是在浏览器中直接输入gmail.com然后登录，登录后也是正常的gmail内容和地址。由于https一般认为是安全的，没有透明的伪装方法，所以，最有可能的是在"http://gmail.com"被google转向为https的过程中出现的。这里有个不负责任的推论：如果直接访问https的地址，应该就没有问题了。