4 ms·
Google.ie DNS was hacked (now fixed)
domain: google.ie
descr: Google, Inc
descr: Body Corporate (Ltd,PLC,Company)
descr: Registered Trade Mark Name
admin-c: KR59-IEDR
tech-c: CCA7-IEDR
registration: 21-March-2002
renewal: 21-March-2013
status: Active
nserver: ns1.farahatz.net
nserver: ns2.farahatz.net
source: IEDR
- thepies 14y agoresolving to nserver: ns1.farahatz.net nserver: ns2.farahatz.net
- edbloom 14y agowell that can't be good! domain not due to expire until 21 March 2013 so looks like their dns records have been hijacked per the original submitter. A records are still going to google for me right now.
- wulczer 14y agoInteresting: $ dig +short @8.8.8.8 google.ie 173.194.39.119 173.194.39.127 173.194.39.120 $ dig +short @ns1.farahatz.net google.ie 119.235.27.219 $ whois 119.235.27.219 (...) descr: PT. TEKNOLOGI LINTASLINK (...)
- freehunter 14y ago[IPv6 Ready] Whois Search Results PDF Print E-mail [Querying whois.domainregistry.ie] [whois.domainregistry.ie] % You have issued 1000 queries today. You have 0 queries per rolling 1 hours. % You have reached your 1 hour limit. Looks like they're blocking lookups for google.ie Edit - actually looks like they're not doing any lookups. Searching anything gives the same error. I haven't done any lookups today for anything, but it thinks I did 1000.
- thepies 14y agojust refresh, it said "10001 queries and -1 queries per rolling -1 hours" a minute ago it seems like it's getting hammered now (the actual site iedr.ie)
- benmanns 14y ago`whois google.ie` returns % Rights restricted by copyright; http://iedr.ie/index.php/mnudomregs/mnudnssearch/96 % Do not remove this notice domain: google.ie descr: Google, Inc descr: Body Corporate (Ltd,PLC,Company) descr: Registered Trade Mark Name admin-c: KR59-IEDR tech-c: CCA7-IEDR registration: 21-March-2002 renewal: 21-March-2013 status: Active nserver: ns1.google.com nserver: ns2.google.com nserver: ns3.google.com source: IEDR person: Kulpreet Rana nic-hdl: KR59-IEDR source: IEDR person: eMarkmonitor Inc nic-hdl: CCA7-IEDR source: IEDR Which looks like it could be cached information. Kulpreet Rana's LinkedIn "also viewed" section seems to identify her as a Google lawyer. The new nameservers are ns1.farahatz.net and ns2.farahatz.net.
- thepies 14y agoI noticed this as I was getting an error similar to SSL received a record that exceeded the maximum permissible length I then did a bit of checking. I am using OpenDNS, which shows 119.235.27.219 as the IP now Even when browser tries to redirect to google.com, it is hanging The IEDR reloads the zonefile next at 5pm, although I suspect they may be a bit quicker about it today...
- bscanlan 14y ago$ dig +trace www.google.ie ... google.ie. 172800 IN NS ns1.farahatz.net. google.ie. 172800 IN NS ns2.farahatz.net. ;; Received 79 bytes from 193.1.142.2#53(193.1.142.2) in 4 ms www.google.ie. 14400 IN CNAME google.ie. google.ie. 14400 IN A 119.235.27.219 google.ie. 86400 IN NS ns2.farahatz.net. google.ie. 86400 IN NS ns1.farahatz.net. $ whois 119.235.27.219 ... route: 119.235.16.0/20 descr: Route object of PT Inet Global Indo descr: ISP descr: Jakarta Barat country: ID origin: AS18351 mnt-by: MAINT-ID-INET changed: hostmaster@idnic.net 20090211 source: APNIC person: Santoso Halim address: Pluit Permai 8 No.3A address: Jakarta-Utara address: Indonesia country: ID phone: +62-21-30047799 fax-no: +62-21-30047798 e-mail: hostmaster@inet.net.id nic-hdl: SH1061-AP mnt-by: MAINT-ID-INET changed: halim@inet.net.id 20061020 source: APNIC
- AlexMuir 14y agoUnfortunately last year Google Ireland barely broke even. A tiny €24mil profit on a turnover of €12.5 BILLION [1] Perhaps some charitable Irish taxpayer could sort their domain name out for them? 1: http://www.irishtimes.com/newspaper/finance/2012/1006/1224324959631.html http://www.irishtimes.com/newspaper/finance/2012/1006/122432...
- notlisted 14y agoHaha. For those not in on the joke, see: http://en.wikipedia.org/wiki/Double_Irish_arrangement http://en.wikipedia.org/wiki/Double_Irish_arrangement
- j_col 14y agoNot sure how that's relevant to this DNS issue?
- overbroad 14y agoNot sure if it's relevant but one of the major "DNS providers" (that preceded Google) also chooses to domicile their operations in Ireland. They could just as well locate anywhere, but I doubt they chose Ireland for tax purposes. That just wouldn't make sense, right?
- stephengillie 14y agoSecondarily, the amount of internet services hosted in Dublin makes it a good spot to host DNS servers too.
- angry-hacker 14y ago'Double Irish With a Dutch Sandwich'
- anons2011 14y agohttp://www.whois.com/whois/google.ie http://www.whois.com/whois/google.ie shows status: Active nserver: ns1.google.com nserver: ns2.google.com nserver: ns3.google.com source: IEDR Domaintools.com shows something else http://whois.domaintools.com/google.ie http://whois.domaintools.com/google.ie Something else that's worth a look at: http://host.robtex.com/ns1.farahatz.net.html#graph http://host.robtex.com/ns1.farahatz.net.html#graph
- thepies 14y agothose results are likely cached http://www.opendns.com/support/cache/ http://www.opendns.com/support/cache/ This would be loading the correct "hacked" entries now google.ie 119.235.27.219
- kiallmacinnes 14y ago# dig +short @8.8.8.8 google.ie (Google DNS #1) 74.125.132.94 # dig +short @8.8.4.4 google.ie (Google DNS #2) 74.125.132.94 # dig +short @208.67.222.222 google.ie (Open DNS #1) 119.235.27.219 # dig +short @208.67.220.220 google.ie (Open DNS #2) 119.235.27.219 # dig +short @ns1.farahatz.net google.ie ;; connection timed out; no servers could be reached # dig +short @ns2.farahatz.net google.ie ;; connection timed out; no servers could be reached # whois 74.125.132.94 ... NetName: GOOGLE ... # whois 119.235.27.219 ... netname: LINTASLINK-ID ...
- alexchamberlain 14y agoSo, the Google DNS servers are returning the correct values? Is it definitely Google's server which has been hacked?
- kiallmacinnes 14y agoNo - It doesn't look like Googles DNS servers have been hacked. It looks like either the IEDR (the guys who manage .ie) have been hacked, or, either Google or eMarkmonitor Inc (whoever they are) had their password for the IEDR systems compromised.
- unbeli 14y agoIt's definitely NOT Google's servers hacked, since at least one other domain (yahoo.ie) was affected.
- kiallmacinnes 14y agoOoo - Interesting. I was about to say that points the finger at the IEDR, but.. "eMarkmonitor Inc" are involved with them too.. # whois yahoo.ie ... person: eMarkmonitor Inc ... That basically means eMarkmonitor or the IEDR were hacked/had passwords stolen.
- dsl 14y agoMarkmonitor handles all the ccTLDs (.ie, .co.uk, .de, etc) for almost all the Fortune 500 companies. If they were hacked you'd see more than two changed .ie domains.
- toyg 14y agoIf the likes of Google (tech-savvy, security-savvy, loads of cash) can't stay safe, the problem is huge.
- kiallmacinnes 14y agoThe fact that the fake nameservers were visible on iedr.ie means that it's likely the .ie TLD, or someone with the keys to google.ie (e.g. eMarkmonitor Inc) were the real cause..
- philjr 14y agoThe IEDR works on a fax based authorisation system for a lot of procedures which is low hanging fruit for an attacker. Any other type of compromise might be more interesting so curious if they'll release how this happened.
- kiallmacinnes 14y agoActually, you can just log directly into the IEDR site to make these changes. I've done this many times..
- philjr 14y agoJust speculating on an attack vector that's pretty low-tech and open to abuse.
- rolmos 14y agoThis reminds me of Google Bolivia giving a certificate error because it points to Google.com: https://www.google.bo/ https://www.google.bo/
- graue 14y agoIt looks like the working URL is https://www.google.com.bo/ https://www.google.com.bo/ Found that out thanks to the technical details in Firefox's SSL error screen, where it says: "www.google.bo uses an invalid security certificate. "The certificate is only valid for the following names: google.com , .google.com , .youtube.com , youtube.com , .youtube-nocookie.com , youtu.be , .ytimg.com , .android.com , android.com , .googlecommerce.com , googlecommerce.com , .url.google.com , .urchin.com , urchin.com , .google-analytics.com , google-analytics.com , .cloud.google.com , goo.gl , g.co , .gstatic.com , .google.ac , ..." and then goes on to list an enormous number of localized Google domains.
- aliks 14y agoPlease Google dont F with - white Seo
- unbeli 14y agoyahoo.ie was hijacked too. Both are back to normal now, the incident duration was about 1h.
- JGNWW 14y agoSo what was the upshot? Both sites were just knocked offline for an hour?
- bashzor 14y agoI'm sorry but what exactly indicates that it's hacked? It says it belongs to Google Inc, the nameservers end in .google.com, what's wrong here?