3

I tried to do a search on this but I had no luck. not sure even what keywords to use. I searched mirror, cache but I haven't found this particular situation.

I found that my ISP (UNE) located in colombia-South America, runs some sort of google server (mirror? chache?). These IP's are: 190.248.34.15 (resolves to cable190-248-34-15.une.net.co) 190.248.34.13 (resolves to cable190-248-34-13.une.net.co) and in fact if I just type those ips on my browser (or you try it in your browser) the google page is shown, even with my username logged in. If I block 190.248.34.15 youtube webpage doesn't load.

I have many questions about this.

First I want to know if is a standar procedure from ISPs outside the USA TO USE IPs THAT DOESN'T RESOLVE TO THE LOCAL GOOGLE AS CACHE SERVERS. what is weird is that the IPs doesn't resolve to something like numberhere.google.com.co

Is that a flaw in the implementation?

Such IP's don't give users trust. Any user checking that would have doubts if those IPs are legit or some one just cloning or spoofing google in some way . (I know that's not possible as the connections to these particular IPs are ssl and the certificates show no problems) But for example, I opened TCPview and saw my laptop connecting to one of those 2 IPs to port 443 and I wasn't using google at that particular moment. I saw that I had some trojan horse. but of course I don't.

Second I want to know if the way this was implemented represents a risk for the passwords and usernames somehow. Seems like perhaps the passwords security relies on how these "mirror" servers operates? idk.

Third, I wonder if because this country (Colombia) has so many issues with armed groups and narcotics trafficking , that could be just an easy way to check the info from and to google to use that for security agencies. What I find unusual is that google announced a cache server for india just this year ( not even a data center) http://trak.in/tags/business/2015/04/15/google-cache-servers-india/ and colombia is far behind them in terms of technology production or the number of the population. So its hard for me to understand why google would create a cache server (if those IPs are a cache server, I don't know how else to call them) in colombia before than in india.

Thanks for your time.

| improve this question | |
  • Trying them from the US -- it looks like they redirect to Google, with SSL certs in-place. – Kaz Wolfe Oct 19 '15 at 4:04
1

The #1 think you should start with is to check the site's certificate chain. It should resolve to a root from this file. See https://pki.google.com/faq.html for more details there. I'd also expect to see Google Internet Authority G2 as the intermediary signer.

I know of other large Internet companies that deal with personal information who have placed edge termination devices into ISP spaces: It's not just Netflix that does this. It does seem odd to use other address space, but I think the SSL chain is the telling point.

... So I went and looked at the certificate chain myself. The certificate is registered to *.googlevideo.com, and I'm assuming from https://peering.google.com/about/faq.html that it's a Google Global Cache device. That it's googlevideo.com specifically hints that it only gets a certain type of directed traffic.

Multiple domain names is one way a provider may allow caching of some traffic (e.g., video content) without disclosing more sensitive information routed to other domains (related user ids or sensitive services such as email).

| improve this answer | |
  • yeah I'll check for that. and that seems to be the case. I found in this answer by @Thomas Porin security.stackexchange.com/questions/55158/… It shows part of the contract and it explains that google ships their own servers to an ISPs registered and qualified to join the GGC "Google Global Cache". The ISP has to install it. I still wonder if in all other countries the ISP use their own IPs. It's just weird for a regular user to see their IP connecting to some random IP on the ISP network – JohnSt Oct 19 '15 at 4:29
0

It's not google servers, it's a local cache server of your internet provider.

It is a common practice to have cache servers for better speeds, stability, and ping, by reducing bandwidth among data providers. They cache only big files such as videos in YouTube. When your browser requests YouTube video, the request will go either way to official Google servers and process the request but will load the video from local cache server if available(I guess it's done by checking the file hash from request with local cache server).

The IP is bought by UNE EPM Telecomunicaciones SA ESP, which is I believe your internet provider(or corporate partner of your provider). It is resolved on une.net.co domain, which is same internet provider in Colombia.

It usually doesn't compromises sensitive data and shouldn't affect overall experience and security.

| improve this answer | |
  • I didn't mean to say that they were google servers but cache servers with google content. I'm not asking if its common practice to have a cache server, I wrote (original caps) if is a standar procedure from ISPs outside the USA TO USE IPs THAT DOESN'T RESOLVE TO THE LOCAL GOOGLE AS CACHE SERVERS. Also, I obviously know that the IP belongs to UNE EPM, as I posted that they resolved to cable190-248-34-XX.une.net.co and I said that UNE was my ISP. – JohnSt Oct 19 '15 at 4:12
  • @JohnSt, as I mentioned, it is a very common practice for providers(especially the ones that outside of US) to have local cache servers from providers. – iamart Oct 19 '15 at 4:15
  • that doesn't answers the question, as the ISP can have a machine installed in colombia and that machine can resolve to something like XXX.google.com.co . After all is very unlikely that this type of cache for google services can be done without help of google. In fact I just found that such cache servers are part of what is called " GGC "Google Global Cache". The machines with all the software are sent to the ISP that joins that network. So my original question remains, about the IP that this ISP choose to use and the security implications (if any) of that – JohnSt Oct 19 '15 at 4:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.