Google.ie DNS was hacked (now fixed) • Hacker News Board

Re: Google.ie DNS was hacked (now fixed)

#21

Post by graue » Tue, Oct 09, 2012, 1:46 PM UTC

rolmos wrote: post #18

This reminds me of Google Bolivia giving a certificate error because it points to Google.com: https://www.google.bo/

It looks like the working URL is https://www.google.com.bo/

Found that out thanks to the technical details in Firefox's SSL error screen, where it says:

"www.google.bo uses an invalid security certificate.

"The certificate is only valid for the following names: google.com , .google.com , .youtube.com , youtube.com , .youtube-nocookie.com , youtu.be , .ytimg.com , .android.com , android.com , .googlecommerce.com , googlecommerce.com , .url.google.com , .urchin.com , urchin.com , .google-analytics.com , google-analytics.com , .cloud.google.com , goo.gl , g.co , .gstatic.com , .google.ac , ..." and then goes on to list an enormous number of localized Google domains.

Re: Google.ie DNS was hacked (now fixed)

#22

Post by JGNWW » Tue, Oct 09, 2012, 1:47 PM UTC

bscanlan wrote: post #13

bscanlan wrote: post #7

$ dig +trace www.google.ie ... google.ie. 172800 IN NS ns1.farahatz.net. google.ie. 172800 IN NS ns2.farahatz.net. ;; Received 79 bytes from 193.1.142.2#53(193.1.142.2) in 4 ms www.google.ie. 14400 IN CNAME google.ie. google.ie. 14400 IN A 119.235.27.219 google.ie. 86400 IN NS ns2.farahatz.net. google.ie. 86400 IN NS ns1.farahatz.net. $ whois 119.235.27.219 ... route: 119.235.16.0/20 descr: Route object of PT Inet Gl…

...and it's been repaired.

For the deeply confused, what happened and why'd it happen so quick?

Re: Google.ie DNS was hacked (now fixed)

#23

Post by j_col » Tue, Oct 09, 2012, 1:59 PM UTC

AlexMuir wrote: post #8

Unfortunately last year Google Ireland barely broke even. A tiny €24mil profit on a turnover of €12.5 BILLION [1] Perhaps some charitable Irish taxpayer could sort their domain name out for them? 1: http://www.irishtimes.com/newspaper/finance/2012/1006/122432...

Not sure how that's relevant to this DNS issue?

Re: Google.ie DNS was hacked (now fixed)

#24

Post by aliks » Tue, Oct 09, 2012, 2:06 PM UTC

Please Google dont F with - white Seo

Re: Google.ie DNS was hacked (now fixed)

#25

Post by unbeli » Tue, Oct 09, 2012, 2:09 PM UTC

yahoo.ie was hijacked too. Both are back to normal now, the incident duration was about 1h.

Re: Google.ie DNS was hacked (now fixed)

#26

Post by unbeli » Tue, Oct 09, 2012, 2:14 PM UTC

alexchamberlain wrote: post #17

kiallmacinnes wrote: post #14

# dig +short @8.8.8.8 google.ie (Google DNS #1) 74.125.132.94 # dig +short @8.8.4.4 google.ie (Google DNS #2) 74.125.132.94 # dig +short @208.67.222.222 google.ie (Open DNS #1) 119.235.27.219 # dig +short @208.67.220.220 google.ie (Open DNS #2) 119.235.27.219 # dig +short @ns1.farahatz.net google.ie ;; connection timed out; no servers could be reached # dig +short @ns2.farahatz.net google.ie ;; connection timed out;…

So, the Google DNS servers are returning the correct values? Is it definitely Google's server which has been hacked?

It's definitely NOT Google's servers hacked, since at least one other domain (yahoo.ie) was affected.

Re: Google.ie DNS was hacked (now fixed)

#27

Post by JGNWW » Tue, Oct 09, 2012, 2:15 PM UTC

unbeli wrote: post #25

yahoo.ie was hijacked too. Both are back to normal now, the incident duration was about 1h.

So what was the upshot? Both sites were just knocked offline for an hour?

Re: Google.ie DNS was hacked (now fixed)

#28

Post by kiallmacinnes » Tue, Oct 09, 2012, 2:24 PM UTC

unbeli wrote: post #26

alexchamberlain wrote: post #17

Earlier quoted context omitted.

So, the Google DNS servers are returning the correct values? Is it definitely Google's server which has been hacked?

It's definitely NOT Google's servers hacked, since at least one other domain (yahoo.ie) was affected.

Ooo - Interesting.

I was about to say that points the finger at the IEDR, but.. "eMarkmonitor Inc" are involved with them too..

# whois yahoo.ie

...

person: eMarkmonitor Inc

...

That basically means eMarkmonitor or the IEDR were hacked/had passwords stolen.

Re: Google.ie DNS was hacked (now fixed)

#29

Post by angry-hacker » Tue, Oct 09, 2012, 2:42 PM UTC

AlexMuir wrote: post #8

Unfortunately last year Google Ireland barely broke even. A tiny €24mil profit on a turnover of €12.5 BILLION [1] Perhaps some charitable Irish taxpayer could sort their domain name out for them? 1: http://www.irishtimes.com/newspaper/finance/2012/1006/122432...

'Double Irish With a Dutch Sandwich'

Re: Google.ie DNS was hacked (now fixed)

#30

Post by philjr » Tue, Oct 09, 2012, 2:51 PM UTC

toyg wrote: post #16

If the likes of Google (tech-savvy, security-savvy, loads of cash) can't stay safe, the problem is huge.

The IEDR works on a fax based authorisation system for a lot of procedures which is low hanging fruit for an attacker. Any other type of compromise might be more interesting so curious if they'll release how this happened.