Slashdot Mirror
Google DNS Glitch Caused Outage
An anonymous reader writes "Google suffered a pretty long outage saturday evening, due to some DNS glitches, according to company spokesperson. All Google services were down for a while, including Gmail and Google AdSense. There seems to be a DNS hijack, as some screen grabs show that Google.com was redirecting to another site, SoGoSearch.com. "
Everyone keeps freaking out because when they run a whois query they get this:
C OM I NE .THAN.SECZY.COM
O M' instead of ns1.gulli.com -- to do EXACTLY what they just did -- got your attention.
GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.
GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENG
GOOGLE.COM
This is NOT at ALL indicative of a hack.
All this means is that gulli.com chose to register a DNS server with their registrar called 'GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.C
Simmer down everyone. If you whois ANY major site you'll see similar things. (Just try Microsoft.com)
May this post be indexed by spiders, and archived for all to see as my Internet epitaph.
homosexual negroes
Results 1 - 10 of about 246,000,000 for google. (620.8 seconds)
I wonder how many people (including myself) figured it was an ISP or local (AKA their network) problem..
So go search Google!
YOU are educated stupid. YOU must seek Time Cube.
As a record store owner, my business faces ruin. CD sales have dropped through the floor. People aren't buying half as many CDs as they did just a year ago. Revenue is down and costs are up. My store has survived for years, but I now face the prospect of bankruptcy. Every day I ask myself why this is happening.
I bought the store about 12 years ago. It was one of those boutique record stores that sell obscure, independent releases that no-one listens to, not even the people that buy them. I decided that to grow the business I'd need to aim for a different demographic, the family market. My store specialised in family music - stuff that the whole family could listen to. I don't sell sick stuff like Marilyn Manson or cop-killer rap, and I'm proud to have one of the most extensive Christian rock sections that I know of.
The business strategy worked. People flocked to my store, knowing that they (and their children) could safely purchase records without profanity or violent lyrics. Over the years I expanded the business and took on more clean-cut and friendly employees. It took hard work and long hours but I had achieved my dream - owning a profitable business that I had built with my own hands, from the ground up. But now, this dream is turning into a nightmare.
Every day, fewer and fewer customers enter my store to buy fewer and fewer CDs. Why is no one buying CDs? Are people not interested in music? Do people prefer to watch TV, see films, read books? I don't know. But there is one, inescapable truth - Internet piracy is mostly to blame. The statistics speak for themselves - one in three discs world wide is a pirate. On The Internet, you can find and download hundreds of dollars worth of music in just minutes. It has the potential to destroy the music industry, from artists, to record companies to stores like my own. Before you point to the supposed "economic downturn", I'll note that the book store just across from my store is doing great business. Unlike CDs, it's harder to copy books over The Internet.
A week ago, an unpleasant experience with pirates gave me an idea. In my store, I overheard a teenage patron talking to his friend.
"Dude, I'm going to put this CD on the Internet right away."
"Yeah, dude, that's really lete [sic], you'll get lots of respect."
I was fuming. So they were out to destroy the record industry from right under my nose? Fat chance. When they came to the counter to make their purchase, I grabbed the little shit by his shirt. "So...you're going to copy this to your friends over The Internet, punk?" I asked him in my best Clint Eastwood/Dirty Harry voice.
"Uh y-yeh." He mumbled, shocked.
"That's it. What's your name? You're blacklisted. Now take yourself and your little bitch friend out of my store - and don't come back." I barked. Cravenly, they complied and scampered off.
So that's my idea - a national blacklist of pirates. If somebody cannot obey the basic rules of society, then they should be excluded from society. If pirates want to steal from the music industry, then the music industry should exclude them. It's that simple. One strike, and you're out - no reputable record store will allow you to buy another CD. If the pirates can't buy the CDS to begin with, then they won't be able to copy them over The Internet, will they? It's no different to doctors blacklisting drug dealers from buying prescription medicine.
I have just written a letter to the RIAA outlining my proposal. Suing pirates one by one isn't going far enough. Not to mention pirates use the fact that they're being sued to unfairly portray themselves as victims. A national register of pirates would make the problem far easier to deal with. People would be encouraged to give the names of suspected pirates to a hotline, similar to TIPS. Once we know the size of the problem, the police and other law enforcement agencies will be forced to take piracy seriously. They have fought the War on Drugs with skill, so why not the War on Piracy?
Thi
Last night, Google Web Accelerator was accelerating just fine... except for the fact that when I tried to make it proxy google.com it told me that the web site wasn't available, and to try search Google for the site. Needless to say, that didn't work either.
Yeah and Slashdot was down with a 503 error yesterday for quite a while. But seriously, Google shouldn't allow this to happen.
The Television Wiki
I wonder how much revenue they lost due to ads being down...
I think it's far more likely that there are quite a few people out there with some sort of malware redirecting their failed DNS lookups to this site, as opposed to Google's DNS entry being hacked.
Ironically people have been freaking out about this, even before slashdot posted the story; leaving comments in other articles
May this post be indexed by spiders, and archived for all to see as my Internet epitaph.
SoGoSearch didn't hijack Google's DNS. They registered a domain name google.com.net. Because the browser couldn't find google.com it tried as google.com.net. It has nothing to do with them hijacking any DNS.
I do think it is unethical to register a domain such as google.com.net if you are not Google, but that is a different thing.
Miguel de Icaza, Bruce Perens, Eric Raymond, and Linus Torvalds all got rich off the Open Source Movement. What do you have to look forward to?
OSDN == Offshore Software Development NOW!!! Read how OSDN is helping to offshore American High-Tech to the Third World!
They were just taking advantage of browser behavior.
.net and .com to the end of the address on the assumption maybe the user forgot to add it.
www.google.com.net leads to sogosearch.com
When a browser fails to resolve an address, they will try adding
The Fedora Core Blog gives a review of the features we can expect from Firefox 1.1. Many uses have been running the latest trunk builds and seeing dramatic improvements in page rendering, managing many tabs quickly, and the much-anticipated fix for the /. layout bug. From the article: 'One major new feature in Firefox 1.1 is the "Sanitize" feature. This enables secure browsing with much more ease. Select the "Sanitize" option in the preferences and Firefox will scrub your profile of sensitive information (which you select in the preferences).'"
Therefore Google sucks ass.
Are people really this dependant on google that when there is an outage, people really flip out?
I mean, there are other search engines.
Other email services.
Other mapping things.
Seriously, what were people doing a couple years ago? If your life is that in tuned to google, maybe its time to 'log off' (and pardon the cliche).
In fact, google.sg was still up. Don't ask me why.
Lots of rumor of DNS getting poison and/or google site getting hacked. The reason benig is people thought google.com was going to SoGoSearch.com..
But apparently it was just their browser's not finding google.com and trying to go to Google.com.net
Stop flipping out!
Excuse me, I don't mean to impose, but I am the ocean
Spock Reliant's prefix number is one-six-three-zero-nine. ... to prevent an enemy to do what we're attempting; using our console
to order Reliant to lower her shields...
Saavik I don't understand -
Kirk You have got to learn WHY things work on a Starship.
Spock Each ship has its own combination code...
Kirk
Spock (at the weapons console) Assuming he hasn't changed the combination. He's quite intelligent...
Thought gmail was slow and Adsens was not working but google.co.in was up and running :)
:-?
However I noticed http://www.google.com/intl/xx-hacker/ don't know what the hell it is... or just one of those google own funny stuff
The important thing is not to stop questioning --Albert Einstein.
Just 216.239.57.99 it.
People of Slashdot! We unite, righteously, against the forces of Microsoft.
Why do we do this? Because Microsoft is evil. Microsoft is a monopoly. We need to escape our dependence on Microsoft.
Yet we all use Google. Google with it's 85% market share. Google with its total control of the web search market. Google with its effective ownership of the web advertising business. Google the monopoly.
Why the hypocrisy? Why do we support one monopoly while rejecting another? Should we not avoid google, even if not to punish them, because we need to be indepenedent of our suppliers. Don't give Google control over the internet. Use the alternatives!
I'd have thought that someone with a low /. ID would eventually have figured out that this was a troll. Guess not; did you purchase the account on eBay?
The message isn't even really to do with Google per se. It might have been Cut and Pasted from a genuine source, and your answer may have been relevant there; but here it's a troll.
I bet you're glad you memorised Google's IP now, aren't you!
Send email from the afterlife! Write your e-will at Dead Man's Switch.
No text
During the outage, I noticed www.google.com wouldn't resolve at all, but I tried google.com (without www.) and that resolved, but the server redirected to www.google.com, so my proxy failed to connect anyway.
Overheard at the Redmond headquarters:
I have you now.
Go to about:config and change browser.fixup.alternate.enabled to false.
They're trying to associate google.com.net with them in an effort to confuse customers. Thus they are guilty of a trademark violation and Google can sue them.
Click here or a puppy gets stomped!
When the Google name servers didn't work, web browsers tried to add ".com" and ".net" to the URL. And http://www.google.com.net/ is Sogosearch, because the "com.net" domain exists and it is owned by Sogosearch.
.tld.tld domain names,
.com/.net/.org/.biz/.edu/.mil.
Just like the "net.com" domain that is also registered by another company.
Culprits are:
- registrar who allows registration of
- web browsers that are trying to add suffixes even though the domain name of the URL already has a known suffix.
Of course the TLD namespace is a moving target, but that rule could at least be enforced with
{{.sig}}
. . . here. Notice this slashdot article is the first referenced. ;)
for the avid readers i'm sure you will remember this article http://it.slashdot.org/article.pl?sid=05/05/04/230 206&tid=109&tid=217&tid=218/ Gates on Google.
Well this is most likely gates new plan of attack for google. He figures if they wont sell out, and he cannot create a search engine of equal (or greater) power, well why not resort to school yard tricks.
I hope google is watching their back....
Arguing with an engineer is like wrestling a pig in mud. Soon, you realize the pig is dirty, and he likes it.
During Q1 2005, Google cashed $657 million by showing sponsored links on search results. This means 300,000 US$ per hour. Taking into account that this issue happened on Saturday (less users), we can estimate the 'non-revenue' figure in 400,000 US$ aprox, without considering other non-working services like Google AdSense, which probably suffered problems during this time.
http://google-blog.dirson.com/post.new/0260/
No, no, it's the spark, there's no spark.
Dumbshit, you're just outa gas!
NEWS? NEWS?
This is news in the sense that the Weekly World News is news.
M'rons speculatin bout DNS resolution when they don't have a klew how it werks.
an utter moron?
I read the title as 'Google Search Causes Outrage'. And it probably did :)
Didn't anyone notice?
Dvorak on Doomtech
google.com: Created on..............: 1997-Sep-15.
One line blog. I hear that they're called Twitters now.
You just know that someone, somewhere, had just installed some new software on their PC ... then went to search for something on Google and BAM! No Google, no GMail, no Google Maps ... nothing. I bet that software is on its way back to CompUSA right now.
It syas things like we didn't install that malware on your coomputer but you should turn off cookies when visiting our site anyway just to be safe
I just tried Microsoft. Hilarious.
This Like That - fun with words!
People of Slashdot! We unite, righteously, against the forces of Microsoft.
Why do we do this? Because Microsoft is evil. Microsoft is a monopoly. We need to escape our dependence on Microsoft.
Yet we all use nitrogen. Nitrogen with it's 80% air share. Nitrogen with its total control of the industrious cooling market. Nitrogen with its effective ownership of the car boosting business. Nitrogen the monopoly.
Why the hypocrisy? Why do we support one monopoly while rejecting another? Should we not avoid nitrogen, even if not to punish them, because we need to be indepenedent of our suppliers. Don't give nitrogen control over the air. Use the alternatives!
This brought to you by the H2S breathing aliens.
Point is : the market share is not important in itself. What is important is, if it's deserved or if it's achieved through illegal means.
Not quite. Other DNS servers don't care about the serial number, only secondary DNS servers of that domain use it to determine if they should do a zone transfer. Other DNS servers relay on the time to live settings in the SOA header to determine if their information is outdated or not, if so it will try to query for fresh info, if not it should still serve from its own cache.
With google down who's going to raise my children!?
This very same thing happened to me a week ago. I documented the screenshots here and here (uploaded on May 1).
I had just installed Tiger 2 days prior, so I suspected a hole the operating system, as you can see by the title of the screenshots. That also prompted me to post a question (along with everything I had learned about what was happening) to Mac Rumors, to see if anyone had known anything at all about this at the time.
Again, this was in the morning Sunday, May 1. Everything I'm reading late last night and this morning seems to indicate that this is the first time anyone is seeing this happen. It's not.
- When you do things right, no one will be sure you've done anything at all.
> They're trying to associate google.com.net with them in an effort to confuse customers.
Hah! I dare Google to sue them and I wish they win.
Then Google will get their ass sued to death by misc. companies whose trademarks Google associates with competitors' ads at a rate of 1000's impressions per minute (if not more).
Google was done for 1 hour or whatever in the past 5 or 6 years. Quit crying.
I was doing a bit of technical research at the time, and when google went out, I just felt so handicaped. It got to the point where I almost consitered going outside! omg! J/k But I did seriousely feel handicapped when it was down.
I have Comcast, which occasionally has DNS issues (when it goes into "does not work" for a couple hours, that's often their DNSes going down).
Anyway, I plugged Googles IP into my hosts file, thus allowing me to get nifty things (like alternative DNSes and how to make my machine use them, along with possible fixes to future problems) from the Gcache.
The fact that they've basically backed up the Internet is, uh, interesting.
This search for cache::memcached (a Perl module) always fails. I reported it to Google several days ago. Other searches, such as for io::socket do not fail similarly.
Got any other searches which always fail with a server error?
When I couldn't connect to google.com, I just loaded up google.co.uk (...and news.google.co.uk) - I guess some of you junkies don't need the fix as bad as I do.
I am Leviathant and I approve this message.
- "+site:TLD" works as advertised
- "-site:TLD" doesn't sometimes
Anybody else with the same experience?The North American Network Operators Group mailing list, which is mainly for discussions between ISP people, had a good bit of discussion about this. Unfortunately, I get my NANOG subscriptions at my Gmail account, so I couldn't read about it there until it was over :-)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
What kind of stupidity is it to blindly append a TLD to a URL that already ends in a valid TLD?
When ".museum" was first added, how would existing browsers know that it is a valid TLD?
I've had my Gmail account open continously throughout this, and Google.ca resolved constantly. Why? I use intelligent caching DNS, and my browsers won't try to magically autocomplete if there is a problem (DNS is handled by Privoxy).
...
Yet still yesterday I kept seeing people panic about, "google being hacked".
Obviously these people need to learn a little about computers, and run their own caching DNS servers. Hopefully ones like djbdns, so they aren't vulnerable to cache poisoning attacks.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
And Google would be wiped out overnight.
People ask for Google by saying its name. If people stop saying its name, it's gone. Poof. A billion dollars of valuation disappear. People learn to use some other search engine pretty easily, at little expense.
A 16 year old can wipe Google off the map.
I can't imagine why anyone would put money in them.
All this means is that gulli.com chose to register a DNS server with their registrar called
No, there was a real (major) DNS hijacking that occurred.
This is a good example of why SPF does not provide solid authentication, and why its promoters are real jackasses for pushing the illusion of security instead of real security. The same people that hijacked Google could have successfully authenticated themselves as anyone to every SPF-using system in the world.
DNS is not, and was never intended to be, a secure system strong against attacks. *No* system that purports to provide authentication (the entire point of SPF) should ever, as a fundamental component of its operation, rely on DNS to be a trusted system. Which SPF does.
If you want an a trusted system that you can use as the core of an authentication system, use PGP/GPG -- not DNS.
Imagine all the people who have Google.com set as their homepage when they start up a web browser. I can't imagine what happened to ISP help desk lines when Joe Bob Family Man hopped onto his computer Saturday night to check a golf score only to find a 404 error or some "page not found" error when he fired up MSIE.
Think about it -- Google just doesn't go down. Not like some websites. It's so simply designed, and in some people's minds, that means it can't fail.
Hell -- I stupidly went into my Linksys router interface after FireFox gave me a startup error to see if my ISP had dropped my connection. I didn't think to look at CNN.com or another website (which were working fine, so NOT an outage). Why?
Google just doesn't go down. Reliance is a real bitch sometimes, no?
IronChefMorimoto
I assumed it was just a case of cache poisoning for those specific servers, and not that Google was dead to the world.
This brings up a very interesting subject, though. If more people used MaraDNS, or added it's features to other DNS servers, nobody would have had this problem. If a DNS lookup fails, it serves the last-known good record, even if it has expired, allowing you to continue to visit many common sites even if the entire DNS system dies (due to DoS or whatnot). It's a shame nobody else has added this feature, it seems like an obvious enough idea to me.
In the short-term, putting a few entries in your hosts file for the important sites you visit will do the trick:
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
The only catch at all was that once you'd changed the domain servers, the domain owner had an email letting them know. If they didn't spot this within 24 hours you could fully transfer ANY domain on the web.
Sadly I was just a dumb 16 year old when I figured this out, so didn't use it wisely, but I took over a bunch of domains (won't name names because I probably caused a lot of lost business) and pointed them at my own little site for about a month before anyone found me. I tried Microsoft.com too, but they saw the transfer going through, blocked it, and chased me up with some very threatening calls.
The funny thing is this exploit was so easy, but I've never heard of anyone else doing it. Was this ever known publicly?
...it happens to a lot of people.
USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
I had no problems accessing google.de. What's strange is that some other people couldn't connect at all.
USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
I've said it before, and I'll say it again, why isn't everyone using Djdns? I've set it up on my home network server running FreeBSD to provide dnscache for all my boxes within 192* and thus far it's working perfectly. From Djdns' security page, it says that it's impervious to DNS poisoning (an perhaps the hack that took down google?): "dnscache does not cache (or pass along) records outside the server's bailiwick; those records could be poisoned. Records for foo.dom, for example, are accepted only from the root servers, the dom servers, and the foo.dom servers." "dnscache is immune to cache poisoning." Djbdns While I don't think I'm in the clear because of this, I feel better protected from the (unwashed ;)) internet. Anyone care to comment, please do, as I've just started using this and want to know how effective it is.
bo
bad_outlook
--
Is this vague enough for you?
I find your ideas intriguing, and wish to subscribe to your newsletter.
USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
Sigh, there we go again. Where I work, we used to have all our databases in Oracle. Today we keep old stuff in Oracle, but new applications are created in Postgres. Why? Because we get better *free* support for Postgres than we get for our paid-for Oracle databases. Why can't we apply the same logic for email?
Have you ever checked the price of nitrogen? Cheaper than beer (or milk, BTW). That's because nitrogen is almost useless. Nitrogen is obtained as a sub-product of oxygen. Oxygen is important because it cuts steel. When you heat steel to almost the melting point with an oxy-acetylen flame and then turn on the oxygen, the steel literally burns, the oxydation of steel under a pure oxygen flow generates enough heat to keep the steel molten. That's how steel plate is cut. But, to get oxygen, you must extract it from air, which is almost 80% nitrogen, so for each pound of oxygen you get four pounds of almost useless nitrogen. FUCK NITROGEN!
Actully, none of the regional googles were affected -- google.co.uk, google.co.th, etc.
Welcome our Google-slaying overlords.
The root cause was definitely NOT a browser problem as it affected other services like telnet and ping. Or are you going to try to tell me that ping is a browser? However, as others have noted, the browsers did incorrectly list the page being viewed as 'http://www.google.com/' instead of 'http://www.google.com.net/'. This happened with several different browsers on several different platforms. Interestingly enough, ping and telnet reported the correct address (www.google.com.net). Depending on when you tried it, and how the entry was cached on your system, you could work around it by typing 'www.google.com.'.
Also, you would not get auto-resolution of "Google.com.net" from "Google.com". You'd get "Google.net".
No one's flipping out, but a DNS attack on Google (if that's what it is) is pretty big 'News for Nerds'.
I knew that . Where is the full detailed breakdown?
Get your own free personal location tracker
They were attacking the RIM
I believe that most versions of PING will do a reverse DNS lookup by default -- first they'll ask the DNS server for the address to match the name, then they'll ask the DNS server for the name to match the address.
I can't say as much for telnet -- many don't report any host name at all. I wouldn't be suprised if many also did reverse DNS lookups, or reported CNAMEs, or other similar setups.
This actually happened to me a month ago for about 2 hours. I believed at the time that it was because of my ISP (Knology.net), because I didn't hear anyone else complaining about it. However, it happened again yesterday to me. Weird.
On Saturday, at about the time they describe, I was trying to access Google (in Kansas) and it was unavailable, but I never got sent to some other site, I was just getting the "unkown host" message--in Firefox and from ping.
Furry cows moo and decompress.
Yeah, so I got hit by it. First, it was only gmail.google.com that went down for me. All of the other parts of google worked fine. That was because my dnsclient on XP had cached the ip of the gmail server that I was using, while the my machine went to the google.com dns server to find gmail. I was on an undependable wireless connection at the time...so I thought it was some funky blocking scheme that my wireless isp was doing. I go back home to my hardwired connection, and it is still not working. I then started making a slashdot article and began doing a little more research because the rest of google seemed to work fine(funnily) ...with a "ipconfig /flushdns" ...it all seemed to start working again, I just thought the servers that cached in my dns had been taken offline and my dnsclient was being crap. So I canceled the article, the problem was resolved.
http://shit.slashdot.org/article.pl?sid=05/05/08/1 33225
Hmmm, oh well
I'm Freaking Out!
looked to me like someone left a '.' off the end of a line after editing a bind config.
www.google.com which is usually a CNAME to www.l.google.com. was temporarially a CNAME to www.l.google.com.l.google.com.
go figure
"We are not tolerant people. We prefer drastically effective solutions"
I'd love to hear about what happened when the searches-per-second meter started dropping like a rock towards zero... The simultaneous WTF?!? emanating from their monitoring centers must have been priceless.
I wonder if running the dns data file through some "lint" utilities prior to roll out will become part of the SOP.