Hackers Hijack Three Country Domains to Obtain Google TLS Certificates

Attackers compromised the .gh, .sl and .as country-code domain namespaces and altered authoritative DNS records. [1]

The changes allowed attackers to pass automated domain-control validation and obtain unauthorized HTTPS certificates for several Google domains. [1]

Google said its own systems were not compromised and that it had no reason to believe the issuing certificate authorities violated requirements. [2]

Chrome blocked the identified certificates through CRLSets, while Google worked with certificate authorities to revoke them. [2]

Google did not disclose the number of certificates or identify the other affected brands and services. [1]

Attackers compromised three country-code top-level domain registries and used control of their DNS infrastructure to obtain unauthorized HTTPS certificates for several Google domains and other major online services, Google said October 6. The affected namespaces were .gh for Ghana, .sl for Sierra Leone and .as for American Samoa. [1]

The attackers altered authoritative DNS records for selected domains, allowing them to satisfy automated domain-control validation checks used by certificate authorities. Google said the incident did not involve a breach of its systems and that it had no reason to believe the certificate authorities that issued the certificates had done anything wrong. [2]

Google blocked the identified certificates in Chrome and worked with the issuing authorities to revoke certificates covering Google properties. Certificate Transparency logs later showed that several leading global brands and widely used online services were also believed to have been affected. [2]

How the attack worked

The campaign targeted the registries responsible for the .gh, .sl and .as country-code domains. Google said the compromises put any domain ending in one of those suffixes at risk while the hijacks were underway. [2]

Attackers changed authoritative DNS records for selected domains and redirected them to infrastructure they controlled. That access allowed them to demonstrate domain control during automated certificate-issuance checks, even though the affected domain owners’ systems were not breached. [1]

Chrome blocked unauthorized certificates covering Google properties through CRLSets, a browser-based mechanism for distributing certificate-blocking information. Google also coordinated with the issuing certificate authorities to revoke the certificates for protection beyond Chrome. [2]

After reviewing Certificate Transparency logs, Google expanded its Chrome blocking actions to certificates associated with additional organizations. The company said Chrome users did not need to take action, but warned that browser-side blocking was not a complete defense because undiscovered certificates and non-Chrome clients could remain exposed. [1]

Recommended safeguards

Google urged organizations to continuously monitor Certificate Transparency logs across their domain portfolios, including parked domains and regional country-code properties. Unexpected certificate issuance can indicate that an attacker has obtained domain-control validation. [2]

The company also recommended restrictive Certification Authority Authorization records, including account and validation-method bindings where supported. Google said those controls cannot prevent issuance during an active DNS hijack, but can limit additional issuance after DNS control is restored. [2]

Google did not identify the affected domains, name the other organizations involved or disclose how many unauthorized certificates were issued. Ars Technica reported that it was also unclear whether every certificate outside Google’s properties had been blocked or revoked. [1]

The incident did not result from a reported compromise of a certificate authority. Instead, attackers used control of upstream domain infrastructure to satisfy the validation process that certificate authorities rely on. [1]