What would happen if someone actually managed to move google.com to a non-google registrar account under their control? Would someone step in and just seize it back? Can you imagine the magnitude of client devices hitting the wrong server for gmail,android updates,chrome even for a few minutes?
I can imagine that such an attack would be dealt with a mix of manual intervention and technical measures, something in between the Google.com search page outage that happens once in a blue moon, and the false routes for YouTube.com IPs that have been propagated several times during the past few years.
Big companies that rely on Internet presence are quite pro-active, and there are teams of people whose job is to prevent something like this from happening in the first place.
DNS is not a secure protocol, and you can redirect connections intended for google.com from the same local network easily, yet the world still keeps turning.
>there are teams of people whose job is to prevent something like this from happening in the first place.
Reading that along with the rest of this thread reminds me just how bad it is to have so much of the internet rely on large sites like this. The amount of trust and dependency that rests on Google is very dangerous. The amount of damage to the world that could result in a failure of their service is beyond imagination.
How exactly would that work. modify an instance of bind and check if the client is requesting to resolve 'google.com'? If true, then respond with the rouge IP? First we must make sure the client machine is set up to use our name servers, the ones we have control over.
You can just set up the zones in e.g. Your local network nameserver to say it's authoritative for google.com then send the traffic to wherever you want. Many companies do this on a large scale on their internal networks for the purpose of having easy-to-use names (that can have the nodes behind them changed out without changing anything else) using, mostly for backward-compatibility or legacy reasons, the same domains / zones that may resolve externally to different RRsets. This is known as split-horizon DNS: https://en.m.wikipedia.org/wiki/Split-horizon_DNS
You don't even need to setup the client, if you have control over any number of intermediate routers, you can snag/reroute port 53 tcp/udp traffic any way you like. I tend to setup my home router to do this, so that all open dns traffic goes where I tell it to.
It's also advised to do so for unauthenticated users on shared/public wifi so that you can provide an agreement page/site. Also, so that unauthenticated users can't use DNS as a tunnel method, which is pretty damned cool, but insecure.
I've done TCP-over-SSH-over-DNS many times (using iodine and sshuttle) and it was actually surprisingly usable! I could get over 200Kbps downstream. Iodine uses NULL requests -if allowed by the recursive DNS server- which can fit 1KB+ per request/reply.
I've set up my laptop to go to my home internal server (old laptop) for DNS. My quality-of-development-environment has increased because I can associate any internal in development app I want with a hostname tied to my internal DNS prefix. Very useful for setting up nginx for multiple applications.
google.com is under a registry lock, nobody can touch it without going through a security song and dance involving the registry (Verisign) and the registrar (MarkMonotor), so it's unlikely to happen.
This looks like because Google's domain selling tool thought he bought the domain, he was authorized for the domain for all the rest of the Google tools, which is scary, but probably not earth shattering. Kind of depends on what you can do in the tools to send people to another site.
If they actually hijacked the domain, they would probably kill their DNS servers, but they could do a lot of things; including likely get some domain control certificates (but likely not from the registrars Google pins to, and a lot of people have google's certificate pins)
The propagation "speed" is the effect of clients honoring the records' TTLs. Clients and intermediate servers are responsible for pulling updates to whatever records they believe are stale; the DNS itself just sits there serving queries.
Clients and caches sometimes disregard the TTL or use their own, so sometimes changes to a record "haven't propagated" to some clients, but what's really going on is something that's supposed to keep its info fresh decided not to.
Though it's possible for clients to get out of date, the story of a built-in propagation speed you can't do anything about is based on misconceptions. The record owner has a lot of say in how and when their records get refreshed.
That depends on the expiry time ("Time To Live / TTL") set for the particular record. Minimum TTL is 1s, and maximum is 2e32 -1 seconds, or slightly over 136 years[1].
Resolver libraries and daemons keep cached results in volatile memory, so in practical terms, if a high TTL is set, the spoofed result will continue to be used until the given machine is rebooted. For some middle boxes, this can be years.
I think the point is -- if the TTL is set low, most ISPs simply ignore it to a minimum setting of at least a few hours. So changing/pointing a Google hostname to a victim might not have that big an impact if done only for a few minutes.
I have seen ever-lower TTLs in the wild, sub-minute even, in the past few years. Even historically, TTLs have in my experience always been respected.
I think what really tends to happen, and this gets the folks confused, is that the initial TTL is high (say, 3 days), then the sysadmin wants to do some changes, and because they want to be able to keep changing the IP quickly, while they're working on it, they set the TTL low (say, 1 minute). Only you cannot retroactively lower the TTL of the records that have been sent previously, they'll expire whenever during the following 3 days.
Your point still stands, mostly. The probability of the old record with a high TTL to be evicted from a resolver's cache during any given short period of time is low.
Back in the day I remember this was true, but nowadays when I make changes to DNS in USA, the change is nearly instantly reflected over here in the UK, and a matter of minutes for apparent propagation worldwide. It's gotten a lot faster!
He never actually owned it. This was just a bug in the Google domains control panel. The source of truth (I believe ICANN) would never showed a change of ownership.
Well, the original post talks about him getting Google Webmaster tools for google.com, which while still not "owning" the domain itself, is interesting because it means more happened than just the domain buying app thinking he owned it.
I'm pretty sure LinkedIn filters by IP address. A long time ago, I noticed they let me through without logging in if I used my home connection, but made me log in if I were connecting through my VPN.
Apparently this happened in 1999 with Microsoft's Passport.com as well [1], and again later with hotmail.co.uk [2]. While I understand that snafus like this can happen, I don't understand why the new owner would simply hand back the domain for essentially no compensation (especially in the case of hotmail.co.uk - this appeared to be a clean transfer of an expired domain). If they let the domain expire, it's fair game and should go for market price.
If a company can reasonably show they own a trademark for a name in a region and should be awarded a domain, registrars will give away the domain. There has been plenty of cases where even old domains were taken away.
You are not awarded a domain name simply because you hold a trademark. There is evidence that domains have been awarded to trademark holders after a UDRP hearing and the trademark holder contested the validity of the registration. Read the UDRP guidelines [0].
There is also the counterpoint of the case of Nissan Motor Co vs. Nissan Computer Corp [1] where Nissan Motors owns the trademarks but have not been granted nissan.com.
Hotmail.co.uk currently has an expiry date of 23-Oct-2015, only three weeks away. I hope they don't forget to renew it this time...
Google.com should be fine until 2020, but I randomly looked up some of their ccTLDs and a lot of them are set to expire in less than a year. Google.co.uk has only four months left.
I wonder why large companies with deep pockets don't just register all of their domains for the maximum duration. There are a few ccTLDs that only allow 1-2 year renewals, but those are few and far between. Most domains can be renewed for 5-10 years at a time.
The oddity of the situation is that the longer you register a domain for, the more likely you are to forget about it's renewal..
However, most big companies use someone like Netnames, MarkMonitor, etc, who simply wouldn't let a domain drop, even if nobody asked them to renew it - instead they'll renew it themselves, keep it active, and simply add it to the next invoice.
Even so, it seems unnecessarily risky for MarkMonitor et al. to renew their customers' domains one year at a time, often at the last minute, instead of keeping a comfortable buffer of two or more years.
I remember a Slashdot article back in the 90s about a guy who renewed hotmail.com for Microsoft when they accidentally let it expire. The guy needed to get to his email but couldn't and he quickly discovered the problem and fixed it for them.
My guess is it's just a bug in Google domains, allowing them to 'register' domains that the lookup RPC failed for. Google doesn't act as the registrar for their own domain, so there was never any risk of the ownership actually getting transferred to him.
Honest question. If he bought the domain from Google and the transaction went through, is that not technically a legitimate transaction and "cancelling" and refunding the money is essentially theft?
How is that any different than walking in to someone's house and leaving them $20 for the TV you took? It seems to me that "oops, take-backs" Is not a legitimate enough justification to reverse a transaction under contract law.
It seems rather ominous if even this kind of situation is permitted because it sets a precedent that corporations can simply decide to change their mind when something is not in their favor. Sure, it's an example that many people will simply rationalize or defend, but just on matters of assuring the credibility of the integrity of the whole market based system, Google should not be allowed to simply step away from this as if nothing happened without at least a fine that gets noticed by the executive suite.
How would you feel if in the future mega consolidated food corporation can arbitrarily decide that "oops, we changed our mind. That food you ate and sold to you for $X should have really been charged at $3X. Don't worry, we will charge your account. Have a nice day"
How about a different scenario; the airline industry decides that "oops, someone else was willing to pay more for that last seat on that flight you just booked. We just cancelled it and refunded your money. Have a nice day"
I get that it was probably a mistake of some kind. But what is it that immunizes corporations from the consequences of mistakes? I guess that's kind of rampant right now in our society and economy, but still.
Google Domains is not the registrar for google.com. MarkMonitor is. Your situation is analogous to agreeing to buy a deep-discount TV from someone off Craigslist, who meets up with you in a hotel parking lot, goes inside with you, points you to the TV in the lobby that you just "bought" and says take it. That TV was not for sale and the person "selling" it didn't own it. It's unreasonable to expect MarkMonitor to honor a sale that couldn't happen because some other registrar messed up.
Mistakes can and do happen in business all the time, because businesses are composed of people and people aren't perfect. The solution is to deal with mistakes in whatever is the most sane way.
There are consumer protection laws that protect both consumers and sellers when mistakes are made like in this case (at least here in Québec and Canada, it must be similar in the US).
Let's say you're selling a 10$ gift card on your website but through some bug/error it's now worth 1000$ (an easy mistake to make, just forget the decimal place). What if someone bought the 1000$ worth gift card for the original intended price of 10$? I'm sure you would invalidate that purchase and send them an email explaining that it was a mistake, and it would be perfectly within your rights to do so.
It goes both ways too, if a mistake is made that advantages the seller, they have to fix it.
The ccTLD register (The IEDR) had a vulnerability in their management portal that was exploited (I believe it was an SQL injection if I recall correctly).
The attacker changed the DNS servers to their own and then put an A name record pointing google.ie to their own server.
The server just displayed a hijacked by page.
It was probably just some kid. If it was a criminal they would have done some thing far more malicious.
yahoo.ie also got hijacked.
It was an absolute pain, for months after the IEDR's portal was disabled, you had to call them to make any changes to any .ie domain.
It is working for me now. At the time of my post, opening the link incognito redirected to the same page as when you click the "Join today" link in the top right: https://www.linkedin.com/start/join?trk=hb_join
To expand on this, google.com is registered through MarkMonitor, which is a registrar. Google Domains is also a registrar. A registrar cannot sell a domain that is owned, and certainly not one that is owned by a client on another registrar! There was some error on the Google Domains side that indicated a domain was available for purchase that was in fact not available for purchase. That's it. The money was refunded when the error was reported. It's the only possible sane solution to the problem.
Your comment implies that the sale should have gone through anyway, which is nonsensical. Otherwise we could have situations where I steal foo.bar from you (which you have registered with, say, NameCheap) by buying it through, say, GoDaddy, which is currently experiencing a similar bug that incorrectly marks your domain as available.
On the 20.09, I received a totally legit invoice from invoice@google.com (99.99€ Candyclub - Bag of Gems). The sender is invoice@google.com, but no names, no other personal information. I thought it was somewhat strange, and reported it, but no answer.
Why? Wouldn't that be a lousy PR stunt? Domain services are the keepers to your most prized possessions and Google's let someone buy their own domain creating this nebulous set of thoughts to where many might think this allowed the person to control google.com itself.
Its just funny that it was an ex-googler buying google.com from Google Domains. and they happened to state the price ($12) in the ad errrr article. relax people. downvotes? come on.
