no google services works anymore

[manarak]

Just now, DaveBKK said:

Interesting such a major outage isn't being covered anywhere in the news.... TheNation, BangkokPost, nor Khaosod English......

it seems to be limited to 3BB

[DaveBKK]

Just now, manarak said:

it seems to be limited to 3BB

 3BB and some reports of TOT as well.

[simoh1490]

2 minutes ago, manarak said:

it seems to be limited to 3BB

...and TOT

[alocacoc]

More and more us sites are affected. Thaivisa works, but can't anymore post or quote.

Sent from my SM-G900F using Tapatalk

[Stocky]

4 minutes ago, simoh1490 said:

...and TOT

Nope, my TOT connection is fine, I have no issues at all.

[carstenp]

7 minutes ago, manarak said:

 

more mysterious:

I checked what domains are hosted on the final server, and it appears not to be youtube.com

 

there are sites like:

1882678.com

1880678.com
1890678.com
1883678.com
1891678.com
1893678.com
1892678.com
yuanpass.com
twinkledeals.org
k121.com

starting to wonder if this might be a hack

 

I do agree something is bad.

 

Domain Name: 1882678.COM
Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Sponsoring Registrar IANA ID: 633
Whois Server: whois.dns.com.cn
Referral URL: http://www.dns.com.cn
Name Server: NS1.HALADE.COM
Name Server: NS2.HALADE.COM
Status: ok https://icann.org/epp#ok
Updated Date: 22-oct-2016
Creation Date: 29-jun-2015
Expiration Date: 29-jun-2017

[alocacoc]

Just checked #3bb on twitter hundreds of people are complaining.

Sent from my SM-G900F using Tapatalk

[simoh1490]

1 minute ago, Stocky said:

Nope, my TOT connection is fine, I have no issues at all.

What nope! As said earlier, MY/MINE TOT connection is subject to the same problem.

[alocacoc]

As long this isn't fixed, I would advise to not send sensitive data out. So knows where they ends. BTW, twitter works not properly as well.

Sent from my SM-G900F using Tapatalk

[Stocky]

5 minutes ago, simoh1490 said:

What nope! As said earlier, MY/MINE TOT connection is subject to the same problem.

Well mine isn't, so it's not a general TOT issue, seems to be 3BB and some areas of Thailand, only.

[manarak]

what's more worrying, is that connections are done to google sites and others that end up on 3BB IP addresses using HTTPS protocol  !!!

 

try for example https://abc.xyz

you will end up on alphabet's website using https, but the IP address belongs to 3BB.

 

is this normal and I worry too much, or is this a bona fide man in the middle attack ??

Edited May 6, 2017 by manarak

[alocacoc]

Can someone translate this? It looks official.

https://pantip.com/topic/36424823

Sent from my SM-G900F using Tapatalk

[DaveBKK]

2 minutes ago, Stocky said:

Well mine isn't, so it's not a general TOT issue, seems to be 3BB and some areas of Thailand, only.

Do you know  how to do a traceroute? Can you do a traceroute on your connection to Youtube and post it?  Curious what is different with your situation.

[manarak]

10 minutes ago, manarak said:

what's more worrying, is that connections are done to google sites and others that end up on 3BB IP addresses using HTTPS protocol  !!!

 

try for example https://abc.xyz

you will end up on alphabet's website using https, but the IP address belongs to 3BB.

 

is this normal and I worry too much, or is this a bona fide man in the middle attack ??

even more worrying - I normally use google's DNS servers on my router, not 3BB's.

it seems google's DNS router's responses are being spoofed and deliver wrong answers for DNS

[RayHaas]

Went to the 3BB service center around the corner as their service number 1530 was not working either. Confirmed that they have problems. Only access possible is by using a VPN account. 

Could not answer when it would be solved again.

[Stocky]

11 minutes ago, DaveBKK said:

Do you know  how to do a traceroute? Can you do a traceroute on your connection to Youtube and post it?  Curious what is different with your situation.

Tracing route to sin10s01-in-f14.1e100.net [216.58.221.78]
over a maximum of 30 hops:

  1     3 ms    12 ms     4 ms  192.168.1.254
  2   114 ms    40 ms     2 ms  113.53.64.1
  3    19 ms     6 ms     9 ms  172.17.28.81
  4    58 ms    32 ms    19 ms  203.113.44.217
  5    52 ms    29 ms    53 ms  203.113.44.181
  6    22 ms    14 ms    23 ms  203.113.37.194
  7    71 ms   129 ms    52 ms  in-addr.net [203.190.250.209]
  8    50 ms    39 ms    32 ms  ten-gi-0-4-0-9.hyi-core-01.net [180.180.255.94]

  9   156 ms   123 ms    49 ms  in-addr.net [203.190.250.43]
 10    38 ms    38 ms    41 ms  108.170.249.227
 11   114 ms    48 ms    49 ms  72.14.233.249
 12    54 ms    50 ms    51 ms  209.85.243.240
 13    54 ms    52 ms    48 ms  108.170.240.161
 14    49 ms    48 ms    48 ms  108.170.232.171
 15    50 ms    50 ms    49 ms  sin10s01-in-f14.1e100.net [216.58.221.78]

Trace complete.

[Stocky]

Google

 

Tracing route to 203.113.48.55 over a maximum of 30 hops

  1   171 ms     5 ms     9 ms  192.168.1.254
  2    28 ms    26 ms     6 ms  113.53.64.1
  3    11 ms     2 ms     2 ms  172.17.28.81
  4   533 ms  1023 ms   610 ms  203.113.44.217
  5  1782 ms  1553 ms  1840 ms  203.113.44.181
  6   397 ms   142 ms    39 ms  203.113.48.55

Trace complete.

[DaveBKK]

2 minutes ago, Stocky said:

Tracing route to sin10s01-in-f14.1e100.net [216.58.221.78]
over a maximum of 30 hops:

  1     3 ms    12 ms     4 ms  192.168.1.254
  2   114 ms    40 ms     2 ms  113.53.64.1
  3    19 ms     6 ms     9 ms  172.17.28.81
  4    58 ms    32 ms    19 ms  203.113.44.217
  5    52 ms    29 ms    53 ms  203.113.44.181
  6    22 ms    14 ms    23 ms  203.113.37.194
  7    71 ms   129 ms    52 ms  in-addr.net [203.190.250.209]
  8    50 ms    39 ms    32 ms  ten-gi-0-4-0-9.hyi-core-01.net [180.180.255.94]

  9   156 ms   123 ms    49 ms  in-addr.net [203.190.250.43]
 10    38 ms    38 ms    41 ms  108.170.249.227
 11   114 ms    48 ms    49 ms  72.14.233.249
 12    54 ms    50 ms    51 ms  209.85.243.240
 13    54 ms    52 ms    48 ms  108.170.240.161
 14    49 ms    48 ms    48 ms  108.170.232.171
 15    50 ms    50 ms    49 ms  sin10s01-in-f14.1e100.net [216.58.221.78]

Trace complete.

Interesting, so  you're getting routed directly to Google's CDN whereas others are being routed off elsewhere and to Cloudflare......

[55Jay]

The normal YT News vid on Thaivisa's front/home page isn't there.  Trying to play any kind of video, the small dialogue box says: "Waiting on googleapis.com".  I don't know anything about the inner workings of all this, so the comments above are interesting to me.

[manarak]

11 minutes ago, DaveBKK said:

Interesting, so  you're getting routed directly to Google's CDN whereas others are being routed off elsewhere and to Cloudflare......

except that on the last hop, the server 216.58.221.78 does not appear to host youtube.

 

this whole thing has got me very worried that we might be seeing a huge man in the middle attack.

Edited May 6, 2017 by manarak

[alocacoc]

Plenty of angry people in 3bb Facebook. But no official statement. That's poor.

Sent from my SM-G900F using Tapatalk

[jaymbkk]

Fot those having this issue with 3BB just do this :

 

- Download www.bullvpn.com

- Create an account

- Install on your PC or Mobile

- Go to your account page and click on "promo code" then enter 3BBfriend and you will get 24h of free high speed VPN

- Connect to either Thailand 1 or Thailand 13

[manarak]

1 minute ago, jaymbkk said:

Fot those having this issue with 3BB just do this :

 

- Download www.bullvpn.com

- Create an account

- Install on your PC or Mobile

- Go to your account page and click on "promo code" then enter 3BBfriend and you will get 24h of free high speed VPN

- Connect to either Thailand 1 or Thailand 13

if you do this, don't forget to also route DNS requests through the VPN

[Assurancetourix]

Hi everybody;

 

I don't know anything about computer but I have eyes and they are open;

 

For me it's maybe a 3BB problem but surely a Google's one ;

 

I am on a 3BB connexion ( a Wimax one ); in a little village in Sakon Nakhon province, without fix phone , cable or fiber .

I can open some of my favorite sites but impossible to open the sites which must pass by a Google connexion; don't know if u can understand me..

When it's written , below on the left side of the page :

" connexion to ajax.googleapis.com " ; nothing wants to open .

[manarak]

1 minute ago, someuser said:

That or check who you want to trust with all your data and check the other vpns as well.

Credit goes to reddit/u/ThatOnePrivacyGuy

 

That One Privacy Guy's VPN Comparison Chart.xlsx

an excel sheet... oh dear....

[alocacoc]

A friend did translate the picture I posted. 3bn says, it's Google's problem. Same as me the support told...

Sent from my SM-G900F using Tapatalk

[manarak]

Just now, Assurancetourix said:

Hi everybody;

 

I don't know anything about computer but I have eyes and they are open;

 

For me it's maybe a 3BB problem but surely a Google's one ;

 

I am on a 3BB connexion ( a Wimax one ); in a little village in Sakon Nakhon province, without fix phone , cable or fiber .

I can open some of my favorite sites but impossible to open the sites which must pass by a Google connexion; don't know if u can understand me..

When it's written , below on the left side of the page :

" connexion to ajax.googleapis.com " ; nothing wants to open .

yes... this might be the case if attackers specifically target google services to extract user data.

[sam84320]

37 minutes ago, alocacoc said:

Plenty of angry people in 3bb Facebook. But no official statement. That's poor.

Sent from my SM-G900F using Tapatalk
 

Could you please post the URL of 3bb Facebook?

[muskoka]

Gmail working just now!

 

in Chiang Mai on 3BB

 

[jollyhangmon]

2 hours ago, deecypher said:

Try Opera with the VPN enabled.

Just got me Opera installed, works fine now - sound advice, thanks ...

Other sites which where affected all day long work there as well  - movie-streamers for example, not obviously google- affiliated but then again seems like many/most pages are somewhat nowadays.