'Malicious' attack probed by Google on its internet traffic

November 13, 2018:

On Tuesday, after several users complained that they were either unable to access Google services like YouTube, the tech giant confirmed the root cause of this was "external" and under investigation.

However, Internet research firm Thousand Eyes claimed that "traffic to certain Google destinations appears to be routed through an ISP in Russia and black-holed at a China Telecom gateway router".

The disruption in Google services was limited to nearly an hour.

The company said, "Throughout the duration of this issue Google services were operating as expected and we believe the root cause of the issue was external to Google. We will conduct an internal investigation of this issue and make appropriate improvements to our systems to help prevent or minimize future recurrence."

According to media reports, G Suite applications like G-mail & Google Drive were not impacted. Google described the issue as "Google Cloud IP addresses being erroneously advertised by internet service providers other than Google".

ThousandEyes named China Telecom, Nigerian-provider MainOne and Russian network operator TransTelekom behind this incident.

ThousandEyes tweeted, "Potential hijack underway. ThousandEyes detected intermittent availability issues to Google services from some locations. Traffic to certain Google destinations appears to be routed through an ISP in Russia & black-holed at a China Telecom gateway router."

Google told the Wall Street Journal that users' data was not compromised, adding that "and that the company has no reason to believe that the incident was malicious".

Source Link