Google.ie DNS was hacked (now fixed)

#1

Post by thepies » Tue, Oct 09, 2012, 12:45 PM UTC

domain: google.ie descr: Google, Inc descr: Body Corporate (Ltd,PLC,Company) descr: Registered Trade Mark Name admin-c: KR59-IEDR tech-c: CCA7-IEDR registration: 21-March-2002 renewal: 21-March-2013 status: Active nserver: ns1.farahatz.net nserver: ns2.farahatz.net source: IEDR

Google.ie DNS was hacked (now fixed)
domainregistry.ie

Re: Google.ie DNS was hacked (now fixed)

#2

Post by thepies » Tue, Oct 09, 2012, 12:45 PM UTC

resolving to

nserver: ns1.farahatz.net nserver: ns2.farahatz.net

Re: Google.ie DNS was hacked (now fixed)

#3

Post by edbloom » Tue, Oct 09, 2012, 12:58 PM UTC

well that can't be good! domain not due to expire until 21 March 2013 so looks like their dns records have been hijacked per the original submitter. A records are still going to google for me right now.

Re: Google.ie DNS was hacked (now fixed)

#4

Post by wulczer » Tue, Oct 09, 2012, 1:02 PM UTC

Interesting:

  $ dig +short @8.8.8.8 google.ie
  173.194.39.119
  173.194.39.127
  173.194.39.120

  $ dig +short @ns1.farahatz.net google.ie
  119.235.27.219

  $ whois 119.235.27.219
  (...)
  descr:          PT. TEKNOLOGI LINTASLINK
  (...)

Re: Google.ie DNS was hacked (now fixed)

#5

Post by freehunter » Tue, Oct 09, 2012, 1:05 PM UTC

[IPv6 Ready] Whois Search Results PDF Print E-mail

[Querying whois.domainregistry.ie] [whois.domainregistry.ie]

% You have issued 1000 queries today. You have 0 queries per rolling 1 hours.

% You have reached your 1 hour limit.

Looks like they're blocking lookups for google.ie

Edit - actually looks like they're not doing any lookups. Searching anything gives the same error. I haven't done any lookups today for anything, but it thinks I did 1000.

Re: Google.ie DNS was hacked (now fixed)

#6

Post by thepies » Tue, Oct 09, 2012, 1:05 PM UTC

I noticed this as I was getting an error similar to

SSL received a record that exceeded the maximum permissible length

I then did a bit of checking.

I am using OpenDNS, which shows 119.235.27.219 as the IP now

Even when browser tries to redirect to google.com, it is hanging

The IEDR reloads the zonefile next at 5pm, although I suspect they may be a bit quicker about it today...

Re: Google.ie DNS was hacked (now fixed)

#7

Post by bscanlan » Tue, Oct 09, 2012, 1:06 PM UTC

$ dig +trace www.google.ie ... google.ie. 172800 IN NS ns1.farahatz.net.

google.ie. 172800 IN NS ns2.farahatz.net.

;; Received 79 bytes from 193.1.142.2#53(193.1.142.2) in 4 ms

www.google.ie. 14400 IN CNAME google.ie.

google.ie. 14400 IN A 119.235.27.219

google.ie. 86400 IN NS ns2.farahatz.net.

google.ie. 86400 IN NS ns1.farahatz.net.

$ whois 119.235.27.219

...

route: 119.235.16.0/20

descr: Route object of PT Inet Global Indo

descr: ISP

descr: Jakarta Barat

country: ID

origin: AS18351

mnt-by: MAINT-ID-INET

changed: hostmaster@idnic.net 20090211

source: APNIC

person: Santoso Halim

address: Pluit Permai 8 No.3A

address: Jakarta-Utara

address: Indonesia

country: ID

phone: +62-21-30047799

fax-no: +62-21-30047798

e-mail: hostmaster@inet.net.id

nic-hdl: SH1061-AP

mnt-by: MAINT-ID-INET

changed: halim@inet.net.id 20061020

source: APNIC

Re: Google.ie DNS was hacked (now fixed)

#8

Post by AlexMuir » Tue, Oct 09, 2012, 1:06 PM UTC

Unfortunately last year Google Ireland barely broke even. A tiny €24mil profit on a turnover of €12.5 BILLION [1]

Perhaps some charitable Irish taxpayer could sort their domain name out for them?

1: http://www.irishtimes.com/newspaper/finance/2012/1006/122432...

Re: Google.ie DNS was hacked (now fixed)

#9

Post by thepies » Tue, Oct 09, 2012, 1:08 PM UTC

freehunter wrote: post #5

[IPv6 Ready] Whois Search Results PDF Print E-mail [Querying whois.domainregistry.ie] [whois.domainregistry.ie] % You have issued 1000 queries today. You have 0 queries per rolling 1 hours. % You have reached your 1 hour limit. Looks like they're blocking lookups for google.ie Edit - actually looks like they're not doing any lookups. Searching anything gives the same error. I haven't done any lookups today for anythi…

just refresh, it said "10001 queries and -1 queries per rolling -1 hours" a minute ago

it seems like it's getting hammered now (the actual site iedr.ie)

Re: Google.ie DNS was hacked (now fixed)

#10

Post by anons2011 » Tue, Oct 09, 2012, 1:09 PM UTC

http://www.whois.com/whois/google.ie

shows

status: Active nserver: ns1.google.com nserver: ns2.google.com nserver: ns3.google.com source: IEDR

Domaintools.com shows something else

http://whois.domaintools.com/google.ie

Something else that's worth a look at: http://host.robtex.com/ns1.farahatz.net.html#graph