From owner-freebsd-security@FreeBSD.ORG  Tue Dec 18 16:41:28 2007
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id E5CBF16A468
	for <freebsd-security@freebsd.org>;
	Tue, 18 Dec 2007 16:41:28 +0000 (UTC)
	(envelope-from luke@digital-crocus.com)
Received: from tau.digital-crocus.com (tau.digital-crocus.com [208.101.15.162])
	by mx1.freebsd.org (Postfix) with ESMTP id B058013C43E
	for <freebsd-security@freebsd.org>;
	Tue, 18 Dec 2007 16:41:28 +0000 (UTC)
	(envelope-from luke@digital-crocus.com)
Received: from luke by tau.digital-crocus.com with local (Exim 4.66 (FreeBSD))
	(envelope-from <luke@digital-crocus.com>) id 1J4fGI-0000Vj-F9
	for freebsd-security@freebsd.org; Tue, 18 Dec 2007 16:25:42 +0000
Received: from cpc1-cmbg3-0-0-cust216.cmbg.cable.ntl.com ([86.7.20.217]
	helo=[10.0.0.105])
	by tau.digital-crocus.com with esmtpa (Exim 4.66 (FreeBSD))
	(envelope-from <luke@digital-crocus.com>)
	id 1J4fGD-0000UK-Ia; Tue, 18 Dec 2007 16:25:42 +0000
From: Luke Marsden <luke@digital-crocus.com>
To: Anjang Aki <mailman.msc@gmail.com>
In-Reply-To: <bcd996c30712180752t3fb767efm4b059d435ee40190@mail.gmail.com>
References: <bcd996c30712180752t3fb767efm4b059d435ee40190@mail.gmail.com>
Content-Type: text/plain
Date: Tue, 18 Dec 2007 16:27:16 +0000
Message-Id: <1197995237.6839.84.camel@glow>
Mime-Version: 1.0
X-Mailer: Evolution 2.12.1 
Content-Transfer-Encoding: 7bit
X-Spam-Score: -3.0
X-Digital-Crocus-Maillimit: done
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Mail-From: luke@digital-crocus.com
X-SA-Exim-Scanned: No (on tau.digital-crocus.com);
	SAEximRunCond expanded to false
X-Authenticated-Sender: luke
X-Complaints: abuse@digital-crocus.com
X-Admin: admin@digital-crocus.com
X-Abuse: abuse@digital-crocus.com (Please include full headers in abuse
	reports)
Cc: freebsd-security@freebsd.org
Subject: Re: Google DNS hacked?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 18 Dec 2007 16:41:29 -0000

Hi,

This is the result of a prefix search on all domains which *start* with
GOOGLE.COM. Hence Google's DNS has not been hacked - rather whoever owns
WEB-HACK.COM (for example) has a scary looking registered sub-(sub-sub-)
domain. This actually has nothing to do with Google since all
sub-domains of WEB-HACK.COM are authoritative for the owners of that
domain.

Hope this clears it up.

Cheers,
Luke Marsden
Digital Crocus

www.digital-crocus.com

On Tue, 2007-12-18 at 23:52 +0800, Anjang Aki wrote:
> Hi! all,
> 
> I dont have any idea how to contact google but if any of you know how
> to or if is there google staff here they might want to know about
> this:
> http://img443.imageshack.us/img443/2903/googlewhoislolliif6.png
> 
> i found this while whoising google.com domain
> 
> sorry if i had posted wrongly here
> 
> regards
>