Attackers Hijack Three ccTLDs to Obtain Google Certificates
Attackers hijacked the .gh, .sl, and .as registries and obtained unauthorized certificates covering Google domains.
Google's Chrome team said attackers compromised the .gh, .sl, and .as country-code registries, changed authoritative DNS records, and obtained unauthorized HTTPS certificates for Google domains and other organizations. Google said its own systems were not compromised and it had no reason to believe the issuing certificate authorities acted improperly. Chrome blocked the rogue Google certificates through CRLSets, and Google worked with the CAs to revoke them after Certificate Transparency logs showed additional affected brands. Google urged owners to monitor CT logs and set restrictive CAA records with ACME account bindings, while noting CAA cannot stop issuance during an active DNS hijack.
- Hijacked registries were .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa).
- Attackers changed authoritative DNS and obtained certificates for Google domains.
- Google said its systems were not compromised and the CAs were not improper.
- Chrome blocked the certificates with CRLSets, and the CAs revoked them.
- CAA cannot prevent issuance while a DNS hijack is still active.
Full article398 words · extracted from infosecurity-magazine.com · click to collapse
Attackers have compromised three country-code top-level domain (ccTLD) registries and obtained unauthorized HTTPS certificates covering several Google domains and sites belonging to other organizations.
The incidents affected the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) namespaces, according to a post published by Google's Chrome Secure Web and Networking Team on October 6. The attackers modified authoritative Domain Name System (DNS) records during the hijacks, putting domains under the three ccTLDs at risk.
Google said the incidents did not involve a compromise of its own systems and that it had no reason to believe the certificate authorities (CAs) that issued the affected certificates had acted improperly.
Chrome Blocks Unauthorized Certificates
Chrome responded by blocking the unauthorized certificates for Google properties through CRLSets, the mechanism Chrome uses to quickly block certificates in emergencies.
Google also worked with the issuing CAs to revoke the certificates so that users of other clients would be protected. Certificate Transparency (CT) logs subsequently revealed additional organizations that Google believed had been affected, including several leading global brands and widely used online services.
Google proactively blocked those certificates in Chrome and said it contacted affected organizations where possible. The company did not identify the additional organizations or disclose how many certificates were obtained.
Google said browser-side blocking should not be relied on because its analysis may not have identified every affected domain and Chrome's interventions do not reliably protect non-Chrome users.
Read more on DNS hijacking: US Thwarts DNS Hijacking Network Controlled by Russian APT28 Hackers
DNS Control Creates Certificate Risk
The incidents demonstrate how a compromise of DNS infrastructure can affect HTTPS trust without directly breaching a website's own systems. By controlling authoritative DNS records, attackers can interfere with the domain-control process used when certificates are issued.
Google recommended that domain owners continuously monitor CT logs across their entire domain portfolios, including parked and regional ccTLD properties. Organizations operating .gh, .sl or .as domains should review recent CT entries for unexpected certificate issuance.
Google also recommended restrictive Certification Authority Authorization (CAA) records with Automatic Certificate Management Environment (ACME) account bindings. While CAA cannot prevent certificate issuance during an active DNS hijack, the company said restoring a restrictive policy afterward stops attackers from reusing cached domain-control validation checks to obtain new certificates.
Google said it will continue working on broader HTTPS ecosystem changes, including reducing certificate validity periods and the reuse of domain-control validation.