Google Domains Impacted by Recent ccTLD Hijacks
Attackers hijacked .gh, .sl, and .as DNS, obtaining unauthorized certificates for Google and other organizations' domains.
Google said last week's hijacks of the Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as) ccTLDs let attackers change authoritative DNS and obtain HTTPS certificates for several Google domains and other organizations. Google said the issuing certificate authorities were not at fault, blocked the unauthorized certificates in Chrome, and worked with those CAs to revoke them. It warned some domains may still be exposed and urged owners of names in those suffixes to monitor Certificate Transparency logs and publish restrictive CAA records so cached domain validation cannot be reused.
- Hijacks hit .gh, .sl, and .as authoritative DNS.
- Attackers obtained HTTPS certificates covering Google and other brands.
- Google blocked the certificates in Chrome and sought revocation.
- Owners should monitor CT logs and set restrictive CAA records.
Full article339 words · extracted from securityweek.com · click to collapse
Google has disclosed that several of its domains were affected by a recent hijack of third-party country-code top-level domains (ccTLDs).
The incident occurred last week and targeted the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs, putting all domains with those suffixes at risk.
“During these hijacks, attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains, as well as domains belonging to other organizations,” the internet giant says.
According to Google, the Certification Authorities (CAs) that issued the certificates are not to be blamed, given the nature of the attacks.
Immediately after learning of the incident, Google blocked the unauthorized certificates for its domains in Chrome and worked with the issuing CAs to revoke them.
Analysis of Certificate Transparency (CT) log data revealed that multiple other organizations, including global brands and popular online services, have been affected.
Advertisement. Scroll to continue reading.
“To ensure users of those sites were kept safe as soon as possible, we proactively blocked these certificates in Chrome. Where possible, we reached out to impacted organizations to alert them to our findings and actions,” Google says.
The internet giant notes that, while it took steps to identify and block the unauthorized certificates, certain domains might still be affected.
Google encourages domain owners to monitor CT logs for all their domains, especially for those in .gh, .sl, or .as, and to publish restrictive CAA DNS records to ensure safeguards after DNS control has been restored.
“Because CAs are permitted to cache and reuse completed domain control validation (DCV) checks for subsequent issuance, restoring a restrictive CAA policy, especially one that restricts issuance to specific authorized accounts and validation methods, prevents an attacker from using cached validation state to mint new certificates after a hijack ends,” Google notes.
Related: Chrome 155 Update Patches 247 Vulnerabilities
Related: Zero Trust Creator Says Model Holds Firm Against AI-Assisted Attacks
Related: Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security
Related: Long-Running NPM Malware Campaign Accumulates 40,000 Downloads