Hackers obtain counterfeit TLS certificates for Google and other large services
Attackers who hijacked three ccTLD registries passed CA domain validation and obtained fraudulent TLS certificates for Google and other major services.
Attackers gained control of three country-code top-level domain registries and changed IP addresses for selected websites, letting them pass certificate authorities' domain-control validation tests and obtain unauthorized TLS certificates for Google and other large services. Google said Chrome blocked suspected unauthorized certificates across the affected ccTLDs but cannot guarantee every affected domain was identified, and browser interventions do not protect non-Chrome users. The affected domain owners' and DNS operators' infrastructure itself was not compromised. Known forged certificates are blocked, but any undiscovered ones remain a threat, echoing the 2011 DigiNotar hack where counterfeit certificates were used against roughly 300,000 users in Iran.
- Attackers controlled three ccTLD registries to alter DNS and pass CA validation.
- Fraudulent TLS certificates issued for Google and other large services.
- Chrome blocked known unauthorized certificates; undiscovered certs remain a threat.
- No domain-owner or DNS-operator infrastructure was compromised.
- Recalls 2011 DigiNotar breach affecting about 300,000 Iranian users.
Full article286 words · extracted from arstechnica.com · click to collapse
“While Chrome took steps during these incidents to identify and block suspected unauthorized certificates across the affected ccTLDs, browser-side intervention should not be relied on to protect your users,” Google said. “Due to the complexity of DNS hijacks, we cannot guarantee that our analysis identified every affected domain, nor do Chrome interventions reliably protect non-Chrome users.”
It’s not immediately clear what the other affected organizations are, how many unauthorized certificates were issued, or if they have been revoked. The process for officially revoking certificates in browsers is slow and cumbersome, so certificate authorities and other stakeholders have devised a quicker method to block specific certificates at the browser level. With all known unauthorized certificates now blocked, the risk is mitigated, but as Google noted, any certificates that remain undiscovered pose a threat.
Google noted that the incident didn’t involve the compromise of the infrastructure of any of the affected domain owners or the DNS operators. With control of the three ccTLDs, the attackers were able to change the IP addresses of a selected list of websites. With the ability to send and receive traffic on those sites, the attackers were able to pass CA tests requiring an applicant to prove it has control of the underlying domain.
This isn’t the first time threat actors have managed to obtain unauthorized certificates. A 2011 hack of Netherlands-based certificate authority DigiNotar allowed attackers to mint counterfeit certificates for Google.com and more than 200 other high-traffic domains. The certificates were used against at least 300,000 people with ties to Iran as they browsed the sites impersonated by the forged certificates. There have been many similar incidents since, most often through failures by certificate authorities but also domain holders.