Google Vietnam Compromised? | Hacker News Reader

Google Vietnam Compromised?

89 pointsdfcowell29 comments

Looks like someone has compromised Google's Vietnam site.

A cursory DNS query for google.com.vn against 8.8.8.8 returns a Cloudflare IP. I'm not a security expert, but seems like something decidedly strange is going on.

As of the posting of this message, this is what is found when accessing the home page: http://imgur.com/wMScgY6

View on HN

Archive.org mirror: https://web.archive.org/web/20150223052409/http://google.com...

Those of us in Vietnam that need to get around this can just browse here:

http://www.google.com/ncr

That will set a cookie that directs searches to the main google.com domain instead of the .vn domain.

It looks more like the Vietnamese NIC was compromised...

Yeah. I just checked:

http://pastebin.com/C7f7zGAK

google.com.vn NS was changed at vnnic.vn whois too -> http://i.imgur.com/6vvZqXS.png

Either VNNIC was hacked or someone got Google credentials... I hope it is the later.

Or their registrar, WebNic.cc perhaps.

Sorry, but why would you hope it was the latter?

Maybe a single customer getting owned is better than all the customers getting owned?

An NIC exploit may be widely repeatable.

Well :| certainly not the first time. http://thehackerspost.com/2013/10/google-malaysia-gets-hacke...

While I'm not 100% sure, it's likely that VNNIC has been 0wned.

Rationale: VNNIC doesn't provide any online DNS management tools. One has to submit a paper request in person to change any DNS records.

Edit: it looks like it's the registrar WebNic.cc that got hacked.

Papers have nothing to do with their infrastructure IMHO..

Man! VNNIC now has EPP Gateway http://www.vnnic.vn/en/domain/eppgateway?lang=en

Using Viettel ADSL with Google DNS and I can confirm this. Google Chrome detected the issue and didn't load at all (http://imgur.com/qoXPj9R). Going through http is fine.

Page source: http://pastebin.com/rHttdwiy

I'm in Saigon, use Google DNS and it's still down for me.

Before when I tried a query on Google, I got the standard SSL warning, which blocked the site and said "your connection is not private".

Now, when I try a query the site just hangs and nothing happens.

Something is certainly up.

Maybe our neighbors way up North are messing around.

I'm total agree with case Webnic.cc has been compromised. "Rationale: VNNIC doesn't provide any online DNS management tools. One has to submit a paper request in person to change any DNS records"-cryptbe Btw, VNNIC redirect any unregister domains to your ads page.

I'm using unblock-us DNS here in Saigon, no problems. Had to sshuttle into a singapore server to post this though.

I'm using Viettel and FPT Internet Connection. I confirmed that Google.com.vn has been defaced.

I don't use 8.8.8.8 as ip for DNS. Still using the site normally.

So, it's DNS redirect... Funny.

PS: I'm in Sai Gon too, all OK for me.

I'm using VNPT and I can confirm this issue too, happened twice.

Hi linuxbuzz, are you located in HCMC?

Yes. I'm in HCMC

Sweet. What do you do here? Are you local or a foreigner? I need some tech savvy friends in vietnam. Seems like I only meet drunkards

You would find some guys on meetup.

Hey, i'm a foreigner techie living in Saigon, what do you need ?

I know some tech savvy drunkards who have moved to Viet Nam, seems like a favourite place for that exact crowd(cheap SIM cards, accommodations, and especially cheap booze).

Another Saigonist here. Always up for ca phe sua da with HNers.

Reply on news.ycombinator.com