Live data from Hacker News

Google.ie DNS was hacked (now fixed)

domainregistry.ie

11–20 of 38 posts

Re: Google.ie DNS was hacked (now fixed)

#11

[IPv6 Ready] Whois Search Results PDF Print E-mail [Querying whois.domainregistry.ie] [whois.domainregistry.ie] % You have issued 1000 queries today. You have 0 queries per rolling 1 hours. % You have reached your 1 hour limit. Looks like they're blocking lookups for google.ie Edit - actually looks like they're not doing any lookups. Searching anything gives the same error. I haven't done any lookups today for anythi…

`whois google.ie` returns

  % Rights restricted by copyright; http://iedr.ie/index.php/mnudomregs/mnudnssearch/96 
  % Do not remove this notice

  domain:       google.ie
  descr:        Google, Inc
  descr:        Body Corporate (Ltd,PLC,Company)
  descr:        Registered Trade Mark Name
  admin-c:      KR59-IEDR
  tech-c:       CCA7-IEDR
  registration: 21-March-2002
  renewal:      21-March-2013
  status:       Active
  nserver:      ns1.google.com  
  nserver:      ns2.google.com  
  nserver:      ns3.google.com  
  source:       IEDR

  person:       Kulpreet Rana
  nic-hdl:      KR59-IEDR
  source:       IEDR

  person:       eMarkmonitor Inc
  nic-hdl:      CCA7-IEDR
  source:       IEDR
Which looks like it could be cached information. Kulpreet Rana's LinkedIn "also viewed" section seems to identify her as a Google lawyer. The new nameservers are ns1.farahatz.net and ns2.farahatz.net.

Re: Google.ie DNS was hacked (now fixed)

#12

http://www.whois.com/whois/google.ie shows status: Active nserver: ns1.google.com nserver: ns2.google.com nserver: ns3.google.com source: IEDR Domaintools.com shows something else http://whois.domaintools.com/google.ie Something else that's worth a look at: http://host.robtex.com/ns1.farahatz.net.html#graph

those results are likely cached

http://www.opendns.com/support/cache/

This would be loading the correct "hacked" entries now

google.ie 119.235.27.219

Re: Google.ie DNS was hacked (now fixed)

#13
post #7

$ dig +trace www.google.ie ... google.ie. 172800 IN NS ns1.farahatz.net. google.ie. 172800 IN NS ns2.farahatz.net. ;; Received 79 bytes from 193.1.142.2#53(193.1.142.2) in 4 ms www.google.ie. 14400 IN CNAME google.ie. google.ie. 14400 IN A 119.235.27.219 google.ie. 86400 IN NS ns2.farahatz.net. google.ie. 86400 IN NS ns1.farahatz.net. $ whois 119.235.27.219 ... route: 119.235.16.0/20 descr: Route object of PT Inet Gl…

...and it's been repaired.

Re: Google.ie DNS was hacked (now fixed)

#14
# dig +short @8.8.8.8 google.ie (Google DNS #1)

74.125.132.94

# dig +short @8.8.4.4 google.ie (Google DNS #2)

74.125.132.94

# dig +short @208.67.222.222 google.ie (Open DNS #1)

119.235.27.219

# dig +short @208.67.220.220 google.ie (Open DNS #2)

119.235.27.219

# dig +short @ns1.farahatz.net google.ie

;; connection timed out; no servers could be reached

# dig +short @ns2.farahatz.net google.ie

;; connection timed out; no servers could be reached

# whois 74.125.132.94

...

NetName: GOOGLE

...

# whois 119.235.27.219

...

netname: LINTASLINK-ID

...

Re: Google.ie DNS was hacked (now fixed)

#15
post #8

Unfortunately last year Google Ireland barely broke even. A tiny €24mil profit on a turnover of €12.5 BILLION [1] Perhaps some charitable Irish taxpayer could sort their domain name out for them? 1: http://www.irishtimes.com/newspaper/finance/2012/1006/122432...

Haha. For those not in on the joke, see: http://en.wikipedia.org/wiki/Double_Irish_arrangement

Re: Google.ie DNS was hacked (now fixed)

#17

# dig +short @8.8.8.8 google.ie (Google DNS #1) 74.125.132.94 # dig +short @8.8.4.4 google.ie (Google DNS #2) 74.125.132.94 # dig +short @208.67.222.222 google.ie (Open DNS #1) 119.235.27.219 # dig +short @208.67.220.220 google.ie (Open DNS #2) 119.235.27.219 # dig +short @ns1.farahatz.net google.ie ;; connection timed out; no servers could be reached # dig +short @ns2.farahatz.net google.ie ;; connection timed out;…

So, the Google DNS servers are returning the correct values? Is it definitely Google's server which has been hacked?

Re: Google.ie DNS was hacked (now fixed)

#19
post #16

If the likes of Google (tech-savvy, security-savvy, loads of cash) can't stay safe, the problem is huge.

The fact that the fake nameservers were visible on iedr.ie means that it's likely the .ie TLD, or someone with the keys to google.ie (e.g. eMarkmonitor Inc) were the real cause..

Re: Google.ie DNS was hacked (now fixed)

#20

# dig +short @8.8.8.8 google.ie (Google DNS #1) 74.125.132.94 # dig +short @8.8.4.4 google.ie (Google DNS #2) 74.125.132.94 # dig +short @208.67.222.222 google.ie (Open DNS #1) 119.235.27.219 # dig +short @208.67.220.220 google.ie (Open DNS #2) 119.235.27.219 # dig +short @ns1.farahatz.net google.ie ;; connection timed out; no servers could be reached # dig +short @ns2.farahatz.net google.ie ;; connection timed out;…

So, the Google DNS servers are returning the correct values? Is it definitely Google's server which has been hacked?

No - It doesn't look like Googles DNS servers have been hacked.

It looks like either the IEDR (the guys who manage .ie) have been hacked, or, either Google or eMarkmonitor Inc (whoever they are) had their password for the IEDR systems compromised.

Post reply on HN