Google DNS Glitch Caused Outage

An anonymous reader writes "Google suffered a pretty long outage saturday evening, due to some DNS glitches, according to company spokesperson. All Google services were down for a while, including Gmail and Google AdSense. There seems to be a DNS hijack, as some screen grabs show that Google.com was redirecting to another site, SoGoSearch.com. "

Comments

Whois Entries Not Indicative of a Hack

[LogicX]

Everyone keeps freaking out because when they run a whois query they get this:

GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.C OM
GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENGI NE .THAN.SECZY.COM
GOOGLE.COM

This is NOT at ALL indicative of a hack.

All this means is that gulli.com chose to register a DNS server with their registrar called 'GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.CO M' instead of ns1.gulli.com -- to do EXACTLY what they just did -- got your attention.

Simmer down everyone. If you whois ANY major site you'll see similar things. (Just try Microsoft.com)

Re:Whois Entries Not Indicative of a Hack

[A beautiful mind]

Also the Screenshots are just about BROWSER GUESSES. The screenshots show http://www.google.com.net!

You know, it's what happens when the browser can't find the given domain name (dns servers are down), that it tries www.google.com.com, then www.google.com.net and it happened to be already taken by the site in the screenshots.

Re:Whois Entries Not Indicative of a Hack

[Megane]

Wow, I thought that trick stopped working like four years or so ago. I even had one of those kind of entries, but took it out when the search stopped showing them.

Looks like these clowns aren't just limiting themselves to Google...

AOL.COM.IS.N0T.AS.1337.AS.GULLI.COM
AOL.COM.IS.0WNED.BY.SUB7.NET
AOL.COM.CANDICE-CHAMBERLAIN.COM
AOL.COM.AINT.GOT.AS.MUCH.FREE.PORN.AS.SECZ.COM
AOL.COM

Re:Whois Entries Not Indicative of a Hack

[AndroidCat]

Because, by default, whois does a search match on the entire record rather than just the name. Since the names of a domain's DNS servers are part of that record, some smartasses with spare domains load up the DNS server names with useless extra strings that will match lookups against popular domains like google.

This only confuses humans, and has nothing to do with Google's outage and overly helpful browser code.

Re:Whois Entries Not Indicative of a Hack

[Wieland]

Mozilla Suite: Edit -> Preferences -> Navigator -> Smart Browsing -> Domain Guessing

Firefox: Go to about:config and set user_pref("browser.fixup.alternate.enabled", false);

Laugh!

[stabChmo]

So go search Google!

Google Web Accelerator

[Message Board]

Last night, Google Web Accelerator was accelerating just fine... except for the fact that when I tried to make it proxy google.com it told me that the web site wasn't available, and to try search Google for the site. Needless to say, that didn't work either.

Pre-FP

[LogicX]

Ironically people have been freaking out about this, even before slashdot posted the story; leaving comments in other articles

SoGoSearch didn't hijack

[Anonymous Coward]

SoGoSearch didn't hijack Google's DNS. They registered a domain name google.com.net. Because the browser couldn't find google.com it tried as google.com.net. It has nothing to do with them hijacking any DNS.

I do think it is unethical to register a domain such as google.com.net if you are not Google, but that is a different thing.

Re:SoGoSearch didn't hijack

[ryanjensen]

Thing is, they didn't register "google.com.net" - they registered "com.net". The "google" part is called a wildcard, and any "*.com.net" would go to SoGoSearch. (See this report about yahoo.sex.com).

The real problem lies in web browsers that append ".net" to a domain name when the .com version cannot be accessed.

Re:SoGoSearch didn't hijack

[Gollum]

In fact, I think they registered com.net, and simply created a wildcard DNS result for anything under that, which points to their search page.

As the parent says, it is common behaviour for browsers to try appending common TLD's to the end of an URL that is not found verbatim. When Google went away, the browser appended .net to google.com, and ended up at *.com.net.

A bug that people seem to be ignoring is that whatever browser is shown in the screenshot did not show the correct URL after the .net was appended, but left the original URL in the location bar.

Re:SoGoSearch didn't hijack

[Dun Malg]

com.net, net.com, etc should be reserved.

A better idea is to not have such brain-dead DWIM "features" in the browser. What kind of stupidity is it to blindly append a TLD to a URL that already ends in a valid TLD?

Re:SoGoSearch didn't hijack

[autocracy]

It's definitely a browser problem. The resolver doesn't do that... the browser makes the other requests after being told NXDOMAIN by the resolver. So, while the issue comes from getting the wrong DNS response, it's because the browser asked the wrong questions thereafter. This also doesn't have to do with search directives. I'm sure there's something you're saying that I'm calling differently than you mean, but it's still an issue of the browser in this case.

Not a hijack

[Kip]

They were just taking advantage of browser behavior.

www.google.com.net leads to sogosearch.com

When a browser fails to resolve an address, they will try adding .net and .com to the end of the address on the assumption maybe the user forgot to add it.

Has it gotten to this point yet?

[fwice]

Are people really this dependant on google that when there is an outage, people really flip out?

I mean, there are other search engines.
Other email services.
Other mapping things.

Seriously, what were people doing a couple years ago? If your life is that in tuned to google, maybe its time to 'log off' (and pardon the cliche).

Re:Has it gotten to this point yet?

[jmaslak]

I'm sorry, but "important" email being sent to a free email account?

If you get important email, I suggest paying for an account that provides support as part of the price. "Free" doesn't typically mean "great support", not even in the case of Google.

Just a DNS glitch

[Eric(b0mb)Dennis]

Lots of rumor of DNS getting poison and/or google site getting hacked. The reason benig is people thought google.com was going to SoGoSearch.com..

But apparently it was just their browser's not finding google.com and trying to go to Google.com.net

Stop flipping out!

So the DNS was down...

[Karakth]

Just 216.239.57.99 it.

Re:It's time to end our dependence on google

[EllF]

...or perhaps we reject Microsoft because we disagree with its corporate goals, and find its products to be substandard, while agreeing with Google's, and find its offering to be exactly what we want?

Google didn't cash 400,000 US$ during that time

[astrab]

According to gigaom.com, Google acknowledges having suffered a 'DNS blackout' for two hours (aprox) this past Saturday, and users couldn't access the search engine.

During Q1 2005, Google cashed $657 million by showing sponsored links on search results. This means 300,000 US$ per hour. Taking into account that this issue happened on Saturday (less users), we can estimate the 'non-revenue' figure in 400,000 US$ aprox, without considering other non-working services like Google AdSense, which probably suffered problems during this time.

http://google-blog.dirson.com/post.new/0260/

Re:It's time to end our dependence on google

[dfjghsk]

Google with it's 85% market share. Google with its total control of the web search market.

Except, its market share is only 35%.. which is far from a monopoly. (For comparison, yahoo is at 32%)

Only here on slashdot does everyone think google completely controls the web search market.

This hit Microsoft as well

[Nichotin]

Didn't anyone notice?

Re:SoGoSearch

[AndroidCat]

Google's DNS was down, browsers did something that most people don't expect. Nothing to see, move along.

Re:Slashdot and Google

[jdgeorge]

I wonder if Google's shareholders feel the same way or if they understand that they do owe their customers? They're a business; they owe me whatever it is I feel like asking for or I'll go elsewhere.

Are you an advertiser on Google? If not, it sounds as if you are confusing what Google owes shareholders (return on investment) and their customers (advertisers) with what Google owes the user, (technically, nothing).

It is true that Google tries to provide a good experience for users, and that helps provide value to the advertisers and return on investment the shareholders are owed.

If, on the other hand, you are an advertiser, you should realize that Google's first obligation is to its shareholders, not its customers or its users.

(Okay, I realize that Google has other customers than advertisers, e.g. those who purchase Google's search services, users of Google Answers, etc., but my impression is that advertising generates the bulk of Google's revenue.)

With google down..

[kun]

With google down who's going to raise my children!?

Re:Good example of why SPF's security holes

[LogicX]

What does SPF have anything to do with this?

If your domain is high-jacked due to a fault with the security of your domain registrar, then yes, you have bigger problems than any anti-spam solution.

This is not the purpose of SPF

If you read spf.pobox.com You can learn that SPF is merely designed to be a system which can eliminate domains being spoofed in the from field of spam messages.

If someone is using one of my domains (logicx.net) to send spam; I can reduce the affect of such a joe-job attack by having a published SPF record; such that receiving systems can verify if the email came from a logicx.net mail server, and reject it appropriately.

SPF and PGP have entirely different authentication approaches. I'd go so far as to say that PGP is more integrity checking.

SPF is a verification that mail for a particular domain came from an appropriate server -- with the goal of disposing false emails (spam, spoofs, etc.)
This is not at all a system to verify users on that particular email system.
This is where PGP steps in -- It is used to verify the integrity of the email -- that it came from a particular user, and came unaltered.

Finally, where has it been verified that their was a breach of their DNS system?

All of the screenshots have now been confirmed to be a firefox situation where when DNS failed it resolved www.google.com.net -- which resolved to the people who own com.net