HN Explorer

Google Vietnam Compromised?

89 points by dfcowell ↗ HN
Looks like someone has compromised Google's Vietnam site.

A cursory DNS query for google.com.vn against 8.8.8.8 returns a Cloudflare IP. I'm not a security expert, but seems like something decidedly strange is going on.

As of the posting of this message, this is what is found when accessing the home page: http://imgur.com/wMScgY6

34 comments

[ 3.3 ms ] story [ 70.7 ms ] thread
[dead] bnb
That guy looks uber l33t h4x0r to me. Excuse me while I purchase some DDOS from this fine fellow for a fair price.
brohee
It looks more like the Vietnamese NIC was compromised...
[deleted]
(comment deleted)
linuxbuzz
google.com.vn NS was changed at vnnic.vn whois too -> http://i.imgur.com/6vvZqXS.png
sondh
Either VNNIC was hacked or someone got Google credentials... I hope it is the later.
xyzzy123
Or their registrar, WebNic.cc perhaps.
cryptbe
While I'm not 100% sure, it's likely that VNNIC has been 0wned.

Rationale: VNNIC doesn't provide any online DNS management tools. One has to submit a paper request in person to change any DNS records.

Edit: it looks like it's the registrar WebNic.cc that got hacked.

anh79
Papers have nothing to do with their infrastructure IMHO..
linuxbuzz
I'm using VNPT and I can confirm this issue too, happened twice.
eddiek85
Hi linuxbuzz, are you located in HCMC?
linuxbuzz
Yes. I'm in HCMC
eddiek85
Sweet. What do you do here? Are you local or a foreigner? I need some tech savvy friends in vietnam. Seems like I only meet drunkards
anh79
You would find some guys on meetup.
bvanalder
Hey, i'm a foreigner techie living in Saigon, what do you need ?
microcolonel
I know some tech savvy drunkards who have moved to Viet Nam, seems like a favourite place for that exact crowd(cheap SIM cards, accommodations, and especially cheap booze).
tomotomo
Another Saigonist here. Always up for ca phe sua da with HNers.
anhtran
I don't use 8.8.8.8 as ip for DNS. Still using the site normally.
CoMaRL
So, it's DNS redirect... Funny.

PS: I'm in Sai Gon too, all OK for me.

narga
I'm using Viettel and FPT Internet Connection. I confirmed that Google.com.vn has been defaced.
[deleted]
(comment deleted)
jonmy
I'm in Saigon, use Google DNS and it's still down for me.

Before when I tried a query on Google, I got the standard SSL warning, which blocked the site and said "your connection is not private".

Now, when I try a query the site just hangs and nothing happens.

Something is certainly up.

Maybe our neighbors way up North are messing around.

cageface
Those of us in Vietnam that need to get around this can just browse here:

http://www.google.com/ncr

That will set a cookie that directs searches to the main google.com domain instead of the .vn domain.

jawngee
I'm using unblock-us DNS here in Saigon, no problems. Had to sshuttle into a singapore server to post this though.
hieudang9
I'm total agree with case Webnic.cc has been compromised. "Rationale: VNNIC doesn't provide any online DNS management tools. One has to submit a paper request in person to change any DNS records"-cryptbe Btw, VNNIC redirect any unregister domains to your ads page.