|
Forensics
message-id formatting Mar 16 2007 06:14AM gdardick dardick net (2 replies) Re: message-id formatting Mar 19 2007 08:52PM Ansgar -59cobalt- Wiechers (bugtraq planetcobalt net) (1 replies) Re: message-id formatting Mar 27 2007 06:50PM Simson Garfinkel (simsong acm org) (1 replies) Re: message-id formatting Mar 27 2007 07:01PM Ansgar -59cobalt- Wiechers (bugtraq planetcobalt net) (2 replies) RE: message-id formatting Mar 29 2007 03:48PM Navroz Shariff (nshariff americanbible org) (1 replies) |
|
Privacy Statement |
Actually, message-id's frequently have internal meaning, depending on
where they are issued. If Apple just wanted a random 128-bit number,
they wouldn't put the dashes in it. There is internal structure --- a
32-bit number, three 16-bit numbers, and a 48-bit number. We just
don't know what those numbers mean.
On Mar 27, 2007, at 12:01 PM, Ansgar -59cobalt- Wiechers wrote:
> On 2007-03-27 Simson Garfinkel wrote:
>> On Mar 19, 2007, at 1:52 PM, Ansgar -59cobalt- Wiechers wrote:
>>> On 2007-03-16 gdardick (at) dardick (dot) net [email concealed] wrote:
>>>> I am trying to find the format of mac.com message-ids. The
>>>> following
>>>> are examples of message-id's received in emails from mac.com.
>>>>
>>>> F39DF6D4-4C64-4C78-91E1-EB9EF83F492A (at) MAC (dot) COM [email concealed]
>>>> 11DF7440-1BAC-4E05-9A6D-5F13C3DA7A53 (at) MAC (dot) COM [email concealed]
>>>>
>>>> Any ideas?
>>>
>>> I'm not sure if I understand your question correctly. Are you
>>> looking
>>> for a regular expression to match those message-IDs?
>>>
>>> [0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}@MAC\.COM
>>
>> No. He's looking for a meaning of what they mean.
>
> Well, they're message-IDs, they don't mean anything by themselves.
> They're just supposed to be unique identifiers for a given message
> (e-mail, in particular).
>
> Regards
> Ansgar Wiechers
> --
> "All vulnerabilities deserve a public fear period prior to patches
> becoming available."
> --Jason Coombs on Bugtraq
>
0? *?H?÷
?0?10 +0? *?H?÷
?0?Ø0?A æÁ-:¾v2½ë]K0
*?H?÷
0b10 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
070303155536Z
080302155536Z0A10UThawte Freemail Member10 *?H?÷
simsong (at) acm (dot) org0 [email concealed]?"0
*?H?÷
?0?
?É$·q¿mÖ@¢f2ÏӥżúÄ!Í3ëÕ?iSSÀ1
CÆ1¸ý¢??ͧ ÝsÒmqt ïSdñèÿ'O(³ eYt?ÍÞãÿ~¥¨,U?SF?(æCUÝèdPPï)]7¯?q?~¨ç<Q\Db4½6$Ã?ÒÎê"vøÇ?¡ÏÅ«ÎK
GǵíÑÙNÇàÂÈ¡xÒ?=z?Ì¿×>{!?dYá?ªrü÷?.üJ?Û,½`KÙyH(Zr]gíâ?¾Á?±???Ýy
¤ÊDÁ;V?dñÁ°©m×Vá??5µLGÌ?/K,D¶j,?¿Yå£,0*0U0simsong@a
cm.org0Uÿ00
*?H?÷
°òjκÚèt}»?Cè?o?!±ª?u o¬õZ]~bào.?ó±ÄÄ
1{?ÂQ},ѽ(´O_p? ¦a9Ó P˲Îù¸ã¸QlÑÇä(v?CͼJ¼n¤-?òÉP?b:?ƵF??U©ÐîÑ?M0??0?¨
0
*?H?÷
0Ñ10 UZA10UWestern Cape10U Cape Town10U
Thawte Consulting1(0&UCertification Services Division1$0"UThawte Personal Freemail CA1+0) *?H?÷
personal-freemail (at) thawte (dot) com0 [email concealed]
030717000000Z
130716235959Z0b10 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0?0
*?H?÷
0?Ħ<UsUûN¹Ê?ZhÀupßéÿ£ì½Íõ[òv½:aò¿QÎÔåP
0×cZ,?p?ÝÉð+?Zª?qV˯<çñ?6$*Ï+Õó?w=¾+þ»>¿@?d×§¦»?eÑÅ*T?H§¶Ñ<
a@dr`·û£?0?0Uÿ0ÿ0CU<0:08 6 4?2http://crl.tha
wte.com/ThawtePersonalFreemailCA.crl0U0)U"0 ¤010UPrivateLabel2-1380
*?H?÷
H?ÑP?ê.Ì
£f¬g¯¬¾Â¡C??L!¸ø6ª-?6/ÀôP ?p<ýáabÃÙ:~?±?Å?t?%P?bÇÛ'qW%Ý©?9?? Oe_?Ú÷÷?ÖÆN®öê4å[5MwãV!x?Ü!5Þ$±ÓFÿ]_eO1?0?0v0b10 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAæÁ-:¾v2½ë]K0 + ?o0 *?H?÷
1 *?H?÷
0 *?H?÷
1
070329160129Z0# *?H?÷
1?ÉÜÀ)x?ø?c<?0? +?71x0v0b10 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAæÁ-:¾v2½ë]K0?*?H?÷
1x v0b10 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAæÁ-:¾v2½ë]K0
*?H?÷
? N5n ñkÛpGû?êÑfFíP?âªlØ^1È0?D/¨güXÙå)Òä;fÆw¶? ÁgÓ ??ªöõ*3we¦TÇ«, Ñ?^ýö>þ??©Ksì7'T&?: à+,
òÆ}$¨ãgÀ??Ë´ÖQ6Ö
?ðêû8ZX`?SÌûO³#ÔPÅ×<?^Ïè~MPÉz?äàÌuXò%=áC%Dõà¶ì§èW×%ã$Fj(C?¾?á?['À
^÷ç+¢W6¹ã[8Quñ¢P=7eãô{J²XZß²Ê[Ok×3»äü>LXUgy&Q¦
[ reply ]