Blog Post

Google (NOT) Hacked? Just A DNS Glitch says Google

Recap: 6:13PM PST: Google was not hacked, but instead had a DNS problem. For some readers the site was redirecting to the SoGoSearch page. That continues to fox me, and I plan to investigate further. All services have been restored. I find it amazing: Google is now as integrated in our lives as a phone company, or heaven forbid, TV networks. Multiple experts say that the screen grab I got was result of broswers not being able to resolve to Google.com, and instead stumbled upon google.com.net (com.net is the SoGoSearch website, and they have a wildcard match). Once Google’s DNS was restored, browsers stopped the appending, and started functioning normally.

Update #6: Yet another screen shot And another one, plus looks like someone swiped the domain name. Larry Magid was on the local CBS radio talking about the Google’s great vanishing trick.

Update #5: Everything back to normal. All Google services are working. Though as an aside, Google has reached the full capacity for its Web Accelerator Beta.

Update # 4: More from Mr. Krane of Google: BTW, this was not the result of a hack or any kind of security issue. “Yes, it was a DNS issue. We’re seeing things as fully restored as of more than 30 min. ago. You’re the first to send such a screen shot and report this kind of issue. I’ll bounce it to the tech staff and will keep you posted.” I got another screenshot which was as of 5.08 PM PST. Not sure if I am having this problem in specific or others noticing the same issue. I use comcast as broadband provider. Any updates people?

Update #3: David Krane, the big cheese @ Google PR wrote back a few seconds ago and had this to add, “Google’s global properties were unavailable for a short period of time earlier today. We’ve remedied the problem and access to Google has been restored worldwide.”

Update #2: Some people are saying in the comments here and over at Engadget, that Google might have been in middle of a DNS software switch. I still can’t believe that a strange image would just show up there.

Update #1: Some people say they have it back, but I am still having trouble logging in to my Gmail. And still not getting Google homepage. I have left voice mail and sent emails to Google’s PR people and their hotline. Not sure, what’s going on precisely but will be on the story.

google hacked

03.11 PM, PST: Looks like we are having a Google outage – apparently someone has hijacked their Domain, and something called SoGoSearch is showing up instead. GMail was down as well. Google ads are not being served up as well. Am I the only one, or did you guys feel the webquake as well? Man if this is a hack, then we now know nothing – not even god, I mean Google is safe! Is this someone’s idea of teaching them a lesson? Or has the Web Accelerator shown its true colors? Lots of unanswered questions. Here is a screen grab by the way!

186 Responses to “Google (NOT) Hacked? Just A DNS Glitch says Google”

  1. As far as the whois stuff goes, look closely. The entry for GOOGLE.COM is still there and intact. Somebody did manage to get in newer entries that include the substring “GOOGLE.COM” and thus also show up on a basic search, which is bad, but that has nothing to do with Google itself. -m

  2. Fred Foobar

    Some browsers redirect to a generic search page when the domain you typed in couldn’t be found (for example, because of a DNS error). This could be how people started seeing ‘SoGoSearch’ and ‘MSN Search’ pages.

    In response to Brendan Loy: The existence of amusing subdomains of gulli.com and seczy.com doesn’t mean Google was hacked. It’s just a joke by the people who own those domains.

    From what I’ve seen here, I see no reason to believe that Google was hacked. It just looks like a DNS screwup. “Never attribute to malice that which can be explained by incompetence”, and all that.

  3. I’ve noticed that all the screenshots are on OS X.

    I noticed this on my OS X box, but not my windows box (when google started responding again) and flushing dns brought back the normal google

  4. It appears this is nothing more than your DNS server f’ing up. Apparently, your side of the world must’ve been redirecting to SoGoSearch for some reason – I (in Michigan) only got an error message saying that Google.com couldn’t be found.

  5. Here’s another screenshot:

    http://img179.echo.cx/img179/7959/googlehacked7to.jpg

    If Google is telling the truth, then this post must be a lie?

    http://hbarbobot.kicks-ass.net/?p=42

    $ whois google.com
    Whois Server Version 1.3
    Domain names in the .com and .net domains can now be registered
    with many different competing registrars. Go to http://www.internic.net
    for detailed information.
    Server Name: GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM
    IP Address: 80.190.192.24
    Registrar: KEY-SYSTEMS GMBH
    Whois Server: whois.rrpproxy.net
    Referral URL: http://www.key-systems.net
    Server Name: GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENGINE.THAN.SECZY.COM
    IP Address: 209.187.114.130
    Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COM
    Whois Server: whois.itsyourdomain.com
    Referral URL: http://www.itsyourdomain.com

  6. Folks, well got an update from Google folks who did clarify and said that there was a DNS glitch. Not a hack. my apologies for an alarmist headline, but it was clear something was up.

  7. Bruce

    This article made me remember an article I read last week in a national IT-magazine, in which they pointed out some of the dangers facing the current Domain Name System (DNS). The article was mostly based on information from a report by the National Research Council.

    A prepublication and more information on that report can be found here:
    CSTB Publication: Signposts in Cyberspace: The Domain Name System and Internet Navigation
    and
    Nat’l Academies Press: Signposts in Cyberspace: The Domain Name System and Internet Navigation

    To which I must admit not having read anything but the summary myself.

  8. Sam Davis

    I noticed that http://www.google.com.net/ redirects to that sogo place. Could this be a result of your browser doing a “best fit” sort of deal when google.com was down? I know Firefox tries to find the best site when the one you enter is wrong, not sure about Safari.

  9. well seriously .. if they were hacked then the hacker didnt do a very good job. i can access gmail and i can use google plus that screen could’ve been taken when they were in the first steps of taking over google

  10. Jamie

    That screenshot is clearly faked – look at the address bar, it still shows the google logo, at the left of the address, this is a line of HTML that changes that image, now would “sogo” or whatever balls it was, really use the google logo?

  11. Apparently, the myDoom virus rearead it’s ugly head again today and flooded googe and gmail with crap. Wy wifes hotmail account, which rarely gets email at all, got 150 infected emails today, so this is confirmed.

  12. Burebista

    It was more like 1/2 h not only 2 minutes and it affected most if not all regional sites as well (.co.uk, .es, .nl, etc)

  13. second hand from the valley

    An issue of changing DNS from a service to a home grown solution is my third-hand knowledge, eavesdropping on a friend’s phone call to employee.

  14. This should be interesting, I wonder ‘if’ google was ever hacked, would they come out and admit it? There must be a emergency meeting going on as we speak with their PR people hehe.

  15. Too funny, the sky is falling, the sky is falling. Hey maybe they had an internal problem or there DNS servers got hosed. Who knows.

  16. Wow, this is amazing. Google being hacked means that we’re all basically screwed from any type of security on the web. I would like to know what really caused this, though. Hopefully something like this won’t happen again.