Forensics
message-id formatting Mar 16 2007 06:14AM
gdardick dardick net (2 replies)
Re: message-id formatting Mar 27 2007 08:16PM
Alexander Klink (alexander klink name)
Re: message-id formatting Mar 19 2007 08:52PM
Ansgar -59cobalt- Wiechers (bugtraq planetcobalt net) (1 replies)
Re: message-id formatting Mar 27 2007 06:50PM
Simson Garfinkel (simsong acm org) (1 replies)
Re: message-id formatting Mar 27 2007 07:01PM
Ansgar -59cobalt- Wiechers (bugtraq planetcobalt net) (2 replies)
Re: message-id formatting Mar 29 2007 04:01PM
Simson Garfinkel (simsong acm org) (2 replies)
Hi, Ansgar.

Actually, message-id's frequently have internal meaning, depending on
where they are issued. If Apple just wanted a random 128-bit number,
they wouldn't put the dashes in it. There is internal structure --- a
32-bit number, three 16-bit numbers, and a 48-bit number. We just
don't know what those numbers mean.

On Mar 27, 2007, at 12:01 PM, Ansgar -59cobalt- Wiechers wrote:

> On 2007-03-27 Simson Garfinkel wrote:
>> On Mar 19, 2007, at 1:52 PM, Ansgar -59cobalt- Wiechers wrote:
>>> On 2007-03-16 gdardick (at) dardick (dot) net [email concealed] wrote:
>>>> I am trying to find the format of mac.com message-ids. The
>>>> following
>>>> are examples of message-id's received in emails from mac.com.
>>>>
>>>> F39DF6D4-4C64-4C78-91E1-EB9EF83F492A (at) MAC (dot) COM [email concealed]
>>>> 11DF7440-1BAC-4E05-9A6D-5F13C3DA7A53 (at) MAC (dot) COM [email concealed]
>>>>
>>>> Any ideas?
>>>
>>> I'm not sure if I understand your question correctly. Are you
>>> looking
>>> for a regular expression to match those message-IDs?
>>>
>>> [0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}@MAC\.COM
>>
>> No. He's looking for a meaning of what they mean.
>
> Well, they're message-IDs, they don't mean anything by themselves.
> They're just supposed to be unique identifiers for a given message
> (e-mail, in particular).
>
> Regards
> Ansgar Wiechers
> --
> "All vulnerabilities deserve a public fear period prior to patches
> becoming available."
> --Jason Coombs on Bugtraq
>

0? *?H?÷
 ?0?1 0 +0? *?H?÷
 ?0?Ø0?A æÁ-:¾v2½ë]K0
 *?H?÷
0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
070303155536Z
080302155536Z0A10UThawte Freemail Member10 *?H?÷
 simsong (at) acm (dot) org0 [email concealed]?"0
 *?H?÷
?0?
?É$·q¿mÖ@¢f2ÏÓ¥żúÄ!Í3ëÕ?iSSÀ1
CÆ­1¸ý ¢??ͧ ÝsÒmqt ïSdñèÿ'O(³ eY t?ÍÞãÿ~¥¨ ,­U?SF?(æCUÝèdPPï)]7¯?q?~¨ç<Q\Db4½6$Ã?ÒÎê"vøÇ?¡ÏÅ«ÎK
GǵíÑÙNÇàÂÈ¡xÒ?=z?Ì¿×>{!?dYá?ªrü÷?.üJ?Û,½`KÙyH(Zr]gíâ?¾Á?±???Ýy

¤ÊDÁ;V?dñÁ°©m×Vá??5µLGÌ?/K,D¶j,?¿Yå£,0*0U0simsong@a
cm.org0 Uÿ00
 *?H?÷
°òjκÚèt}»?Cè?o?!±ª?u o¬õZ]~bào.?ó±ÄÄ
1{?ÂQ },ѽ(´O_p? ¦a9Ó P˲Îù¸ã¸QlÑÇä(v? C­ͼJ¼n¤-?òÉP?b:?ƵF?? U©ÐîÑ?M0??0?¨ 
0
 *?H?÷
0Ñ1 0 UZA10U Western Cape10U Cape Town10U
Thawte Consulting1(0&U Certification Services Division1$0"UThawte Personal Freemail CA1+0) *?H?÷
 personal-freemail (at) thawte (dot) com0 [email concealed]
030717000000Z
130716235959Z0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0?0
 *?H?÷
0?Ä¦<UsUûN¹Ê?ZhÀupßéÿ£ì½Íõ[òv½ :aò¿QÎÔåP
0×cZ,?p?ÝÉð+?Zª?qV˯< çñ?6$*Ï+Õó?w=¾+þ»>¿@?d×§¦»?eÑÅ*T?H§¶Ñ<
a@dr`·û£?0?0Uÿ0ÿ0CU<0:08 6 4?2http://crl.tha
wte.com/ThawtePersonalFreemailCA.crl0 U0)U"0 ¤010UPrivateLabel2-1380
 *?H?÷
H?ÑP?ê .Ì
£f¬g¯¬¾Â¡C??L!¸ø6ª-?6/ÀôP ?p<ý­áabÃÙ:~?±?Å ?t?%P?bÇÛ'qW%Ý©?9?? Oe_?Ú÷÷?ÖÆN®öê4å[5MwãV!x?Ü!5Þ$±ÓFÿ]_eO1?0? 0v0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAæÁ-:¾v2½ë]K0 + ?o0 *?H?÷
 1  *?H?÷
0 *?H?÷
 1
070329160129Z0# *?H?÷
 1?ÉÜÀ)x?ø?c<?0? +?71x0v0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAæÁ-:¾v2½ë]K0? *?H?÷
  1x v0b1 0 UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAæÁ-:¾v2½ë]K0
 *?H?÷
? N5n ñkÛpGû ?êÑfFíP?âªlØ^1È0?D/¨güXÙå)Òä;fÆw¶? ÁgÓ ??ªöõ*3we¦TÇ«, Ñ?^ýö>þ??©Ksì7'T&?: à+,
òÆ}$¨ãgÀ??Ë´ÖQ6Ö
?ðêû8ZX`?SÌûO³#ÔPÅ×<?^ϐè~MPÉz?äàÌuXò%=áC%Dõà¶ì§èW×%ã$­Fj(C?¾?á?['À
^÷ç+¢W6¹ã[8Quñ¢P=7eãô{J²XZß²Ê[Ok×3»äü>LXUgy&Q¦

[ reply ]
Re: message-id formatting Mar 30 2007 11:46AM
Florian Weimer (fw deneb enyo de)
Re: message-id formatting Mar 29 2007 05:28PM
Ansgar -59cobalt- Wiechers (bugtraq planetcobalt net)
RE: message-id formatting Mar 29 2007 03:48PM
Navroz Shariff (nshariff americanbible org) (1 replies)
Re: message-id formatting Mar 29 2007 03:58PM
Ansgar -59cobalt- Wiechers (bugtraq planetcobalt net)


 

Privacy Statement
Copyright 2010, SecurityFocus