6

I am not sure if this is actually an issue or not or if I am just being too paranoid, but I noticed this upon arriving home to Alaska recently (location is important as you'll see shortly). In short, I installed a tool called PeerBlock which blocks connections to advertising and malicious servers (and also has a particular dislike for educational, ISP and government servers) while I was away and noticed something strange when I got back. Google and Youtube connections were being blocked by PeerBlock under the basis of it being "Alaska Communications Systems Group, Inc", which is my ISP.

The result was dozens of messages like this in its log, note the time stamp showing how many happen at once:

PeerBlock Messages

Now I have seen in the past PeerBlock block various websites for silly reasons simply because of what they use for hosting, so I did not take this without a grain of salt. I decided to look into it a bit more by running the command dig @8.8.8.8 google.com on one of my Linux machines and got the following result:

; <<>> DiG 9.9.5-3ubuntu0.8-Ubuntu <<>> @8.8.8.8 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13297
;; flags: qr rd ra; QUERY: 1, ANSWER: 15, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             299     IN      A       204.17.140.109
google.com.             299     IN      A       204.17.140.117
google.com.             299     IN      A       204.17.140.102
google.com.             299     IN      A       204.17.140.83
google.com.             299     IN      A       204.17.140.91
google.com.             299     IN      A       204.17.140.87
google.com.             299     IN      A       204.17.140.123
google.com.             299     IN      A       204.17.140.106
google.com.             299     IN      A       204.17.140.113
google.com.             299     IN      A       204.17.140.98
google.com.             299     IN      A       204.17.140.79
google.com.             299     IN      A       204.17.140.121
google.com.             299     IN      A       204.17.140.108
google.com.             299     IN      A       204.17.140.94
google.com.             299     IN      A       204.17.140.93

;; Query time: 118 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sun Apr 24 13:32:34 AKDT 2016
;; MSG SIZE  rcvd: 279

Note 8.8.8.8 was used as that is the nameserver my main computer uses as well, not the router's or anything.

Now at this point I was a bit concerned, as indeed the IP range 204.17.140.0/24 reported by DiG is owned by ACS as seen here, and I doubt that page has inaccurate information.

I asked some of my friends as well to see if this was a common thing (Google somehow reporting ISP A records like that as it didn't happen where I was from previously), and they all showed that using 8.8.8.8 as well they got actual Google-owned IP ranges.

The odd thing too is that visiting Google by disabling PeerBlock still shows a valid SSL certificate, so I do not think the information I send is being monitored or anything unless there is some way to fake the authenticity of a SSL cert via MITM without having some sort of client side program changing what the browser thinks is valid as far as I know.

Is this something to be concerned about (as mind you, this only happens with Google which is a bit suspicious), or is this a common thing ISPs do? Or perhaps is this just Google taking advantage of the ISP's servers to provide better response times to people living so far away from most servers due to the physical location?

Improve this question
2
  • ... Is it a certificate for the domain name or the IP? If the latter, MITM is a possibility - and the cert would check out correctly because the IP matches the domain (according to a non-DNSSEC-DNS response at least)
    – Tobi Nary
    Commented Apr 24, 2016 at 23:49
  • @SmokeDispenser Yeah it is for *.google.com among other things, so its definitely the correct one.
    – Lemon Drop
    Commented Apr 25, 2016 at 1:49

1 Answer 1

Reset to default
11

Google has some servers (Edge Nodes) located into ISPs for quicker response, this is what they call the Google Global Cache. They are basically big proxy caches for serving static content (such as YouTube videos).

According to their FAQ, it is «designed for end-user networks with greater than 1Gbps of peak Google traffic»

As you have observed, Alaska Communication Systems seems to have some servers deployed in this way. Given that they have a valid Google https certificate, they seem completely legitimate.

Improve this answer
3
  • 1
    Yep, sounds like googles CDN has a few boxes in alaska. Can you imagine how slow DNS resolution would be if the cache was all the way down in CA.
    – Daisetsu
    Commented Apr 25, 2016 at 0:09
  • 1
    I mean I'm gonna accept this because it's what seems the most plausible, but does Google actually specifically say this anywhere?
    – Lemon Drop
    Commented Apr 25, 2016 at 1:50
  • @lemondrop I have expanded the answer mentioning the Google Global Cache, see peering.google.com for the details
    – Ángel
    Commented Apr 25, 2016 at 20:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .