Re: analyzing client / server traffic

From: James Washer <washer(at)trlp.com>
Date: Fri Apr 04 2003 - 13:34:56 EST

one trick I've used, which gives me a 'hint' of whether or not applications are really ecrypting, or just some form of compression/encoding is to attempt to send a HUGE block of a single character.. say 10000 'a's or something like that.. doesn't always work... but sometimes I'll see a huge block of some repeating pattern in the data stream... which means no encryption.. Sort of a 'known plaintext attack'. From there, you can try different plaintext blocks.. and can sometimes figure out the encoding.

Not very scientific mind you... but occaisonally useful

• jim

On 3 Apr 2003 15:31:40 -0000
J J <j_joensuu@yahoo.com> wrote:

>
>
> Dear all,

---

SurfControl E-mail Filter puts the brakes on spam, viruses and malicious code. Safeguard your business critical communications. Download a free 30-day trial: http://www.securityfocus.com/SurfControl-security-basics Received on Fri Apr 4 19:13:27 2003