started · updated
Google reports unauthorized TLS certificates via ccTLD hijack
Hackers successfully seized control of three country-code top-level domains (ccTLDs): Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as). By hijacking these domains, attackers were able to manipulate authoritative DNS records and nameserver delegations. This allowed them to pass automated domain validation checks used by certificate authorities, resulting in the issuance of unauthorized TLS certificates for Google and other major services.
Google responded by updating Chrome to block the identified fraudulent certificates. While the company stated that the infrastructure of the affected domain owners was not compromised and that certificate authorities followed standard protocols, it warned that browser-side interventions cannot guarantee total protection for all users. Google also noted that undiscovered certificates may still pose a threat.
To mitigate future risks, Google recommended that domain owners implement Certificate Authority Authorization (CAA) DNS records to restrict which authorities can issue certificates for their domains, and to monitor Certificate Transparency logs.
Entities
American Samoa · Chrome · Ghana · Google · Sierra Leone
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 4 SOURCES] Attackers changed authoritative DNS records and nameserver delegations to pass domain validation checks. dijitaliyidir.com · www.ithome.com · arstechnica.com
- [● 4 SOURCES] Attackers seized control of three country-code top-level domains (ccTLDs). dijitaliyidir.com · www.ithome.com · arstechnica.com
- [● 3 SOURCES] The incident did not involve the compromise of the infrastructure of the affected domain owners. dijitaliyidir.com · arstechnica.com
- [● 2 SOURCES] Google advised domain owners to use Certificate Authority Authorization (CAA) DNS records. dijitaliyidir.com · www.ithome.com
- [● 2 SOURCES] Chrome was updated to block the identified unauthorized certificates. dijitaliyidir.com · www.ithome.com
- [● 2 SOURCES] The affected ccTLDs are .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). dijitaliyidir.com · www.ithome.com
- [● 3 SOURCES] Certificate authorities followed all requirements during the issuance process. dijitaliyidir.com · arstechnica.com
- [● 4 SOURCES] Attackers obtained unauthorized TLS certificates for Google and other large services. dijitaliyidir.com · www.ithome.com · arstechnica.com