Live data from Hacker News

Someone bought 'Google.com' from Google for one minute

finance.yahoo.com

71–80 of 100 posts

Re: Someone bought 'Google.com' from Google for one minute

#71

He never actually owned it. This was just a bug in the Google domains control panel. The source of truth (I believe ICANN) would never showed a change of ownership.

Well, the original post talks about him getting Google Webmaster tools for google.com, which while still not "owning" the domain itself, is interesting because it means more happened than just the domain buying app thinking he owned it.

He bought it using googles own domain buying app, Presumably it is connected to the rest of googles stuff and the other way around.

Re: Someone bought 'Google.com' from Google for one minute

#73
post #56
post #55

On the 20.09, I received a totally legit invoice from invoice@google.com (99.99€ Candyclub - Bag of Gems). The sender is invoice@google.com, but no names, no other personal information. I thought it was somewhat strange, and reported it, but no answer.

It's extemely simple to fake the sender of email. That's what probably happened.

I just thought it's strange, becuase gmail usually detects email spoofing.

Re: Someone bought 'Google.com' from Google for one minute

#74
post #20

Earlier quoted context omitted.

You don't even need to setup the client, if you have control over any number of intermediate routers, you can snag/reroute port 53 tcp/udp traffic any way you like. I tend to setup my home router to do this, so that all open dns traffic goes where I tell it to. It's also advised to do so for unauthenticated users on shared/public wifi so that you can provide an agreement page/site. Also, so that unauthenticated users…

I've set up my laptop to go to my home internal server (old laptop) for DNS. My quality-of-development-environment has increased because I can associate any internal in development app I want with a hostname tied to my internal DNS prefix. Very useful for setting up nginx for multiple applications.

You can do it locally with dnsmasq or using xip.io, without an extra server.

Re: Someone bought 'Google.com' from Google for one minute

#76
In Ireland some one managed to redirect google.ie (The irish google search domain):

http://technology.ie/google-ie-hijacked/

The ccTLD register (The IEDR) had a vulnerability in their management portal that was exploited (I believe it was an SQL injection if I recall correctly).

The attacker changed the DNS servers to their own and then put an A name record pointing google.ie to their own server.

The server just displayed a hijacked by page.

It was probably just some kid. If it was a criminal they would have done some thing far more malicious.

yahoo.ie also got hijacked.

It was an absolute pain, for months after the IEDR's portal was disabled, you had to call them to make any changes to any .ie domain.

Re: Someone bought 'Google.com' from Google for one minute

#78

Earlier quoted context omitted.

You don't even need to setup the client, if you have control over any number of intermediate routers, you can snag/reroute port 53 tcp/udp traffic any way you like. I tend to setup my home router to do this, so that all open dns traffic goes where I tell it to. It's also advised to do so for unauthenticated users on shared/public wifi so that you can provide an agreement page/site. Also, so that unauthenticated users…

Also, so that unauthenticated users can't use DNS as a tunnel method, which is pretty damned cool, but insecure. You can put TLS into a DNS tunnel too, it's just even slower.

I've done TCP-over-SSH-over-DNS many times (using iodine and sshuttle) and it was actually surprisingly usable! I could get over 200Kbps downstream. Iodine uses NULL requests -if allowed by the recursive DNS server- which can fit 1KB+ per request/reply.

Re: Someone bought 'Google.com' from Google for one minute

#79
post #14
post #8

Earlier quoted context omitted.

I can imagine that such an attack would be dealt with a mix of manual intervention and technical measures, something in between the Google.com search page outage that happens once in a blue moon, and the false routes for YouTube.com IPs that have been propagated several times during the past few years. Big companies that rely on Internet presence are quite pro-active, and there are teams of people whose job is to pre…

How exactly would that work. modify an instance of bind and check if the client is requesting to resolve 'google.com'? If true, then respond with the rouge IP? First we must make sure the client machine is set up to use our name servers, the ones we have control over.

Never use a rouge IP. They're red for a reason, man.

Re: Someone bought 'Google.com' from Google for one minute

#80
Honest question. If he bought the domain from Google and the transaction went through, is that not technically a legitimate transaction and "cancelling" and refunding the money is essentially theft?

How is that any different than walking in to someone's house and leaving them $20 for the TV you took? It seems to me that "oops, take-backs" Is not a legitimate enough justification to reverse a transaction under contract law.

It seems rather ominous if even this kind of situation is permitted because it sets a precedent that corporations can simply decide to change their mind when something is not in their favor. Sure, it's an example that many people will simply rationalize or defend, but just on matters of assuring the credibility of the integrity of the whole market based system, Google should not be allowed to simply step away from this as if nothing happened without at least a fine that gets noticed by the executive suite.

How would you feel if in the future mega consolidated food corporation can arbitrarily decide that "oops, we changed our mind. That food you ate and sold to you for $X should have really been charged at $3X. Don't worry, we will charge your account. Have a nice day"

How about a different scenario; the airline industry decides that "oops, someone else was willing to pay more for that last seat on that flight you just booked. We just cancelled it and refunded your money. Have a nice day"

I get that it was probably a mistake of some kind. But what is it that immunizes corporations from the consequences of mistakes? I guess that's kind of rampant right now in our society and economy, but still.

Post reply on HN