Threat actors gained control of three country-code top-level domains—.gh, .sl, and .as—and leveraged this access to obtain fraudulent TLS certificates for Google properties and multiple other organizations, according to an announcement from Google on Tuesday.
The attackers modified authoritative DNS records for selected domains within those namespaces, enabling them to bypass automated domain validation checks required by certificate authorities. By establishing control over DNS records, they were able to demonstrate domain ownership to certification authorities and receive unauthorized certificates for numerous high-profile services. Google stated it identified unauthorized certificates for several of its own domains as well as for leading global brands and widely used online services, though the company did not publicly name the affected organizations beyond its own properties.
TLS certificates serve as cryptographic credentials that establish the authenticity and enable encryption of websites, mail servers, and other internet infrastructure. These digital certificates bind domain names to specific cryptographic keys, allowing users to verify they are connecting to legitimate services rather than fraudulent imitations. Unauthorized possession of such certificates permits attackers to impersonate affected organizations and infrastructure.
Google updated its Chrome browser to block all identified unauthorized certificates and coordinated with certificate authorities to revoke those issued for Google domains. However, the company cautioned that browser-level protections should not be the sole security measure and recommended that domain owners monitor certificate transparency logs for unexpected issuance, implement restrictive Certification Authority Authorization DNS records, and take additional precautions. The search giant acknowledged the limitations of browser-side interventions, noting that protections may not reliably extend to non-Chrome users.
The incident marks another example of unauthorized certificate issuance affecting major services. A comparable attack in 2011 compromised the Dutch certificate authority DigiNotar, resulting in fraudulent certificates for Google and over 200 additional high-traffic domains that were subsequently deployed against approximately 300,000 users.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI