Google disclosed that threat actors successfully compromised the .gh, .sl, and .as country-code top-level domains and leveraged their control to issue unauthorized TLS certificates for Google properties and multiple other prominent organizations.
The attackers gained access to authoritative DNS records within those domain namespaces, which allowed them to satisfy automated domain validation requirements and obtain the unauthorized certificates from certification authorities. By possessing these certificates, the attackers acquired cryptographic credentials that could enable them to impersonate the affected websites and services. Google stated it identified unauthorized certificates for “several Google domains” and “several leading global brands and widely used online services,” though the company did not publicly name the other affected organizations or specific Google domains targeted.
Google responded by updating its Chrome browser to block all certificates identified as unauthorized and coordinated with relevant certification authorities to revoke the unauthorized certificates issued for Google properties. However, Google cautioned that browser-level protections have limitations and that domain owners should implement additional safeguards. The company recommended that organizations monitor certificate transparency logs for unexpected certificate issuance, establish restrictive Certification Authority Authorization DNS records, and avoid relying exclusively on browser interventions to protect users, particularly given that non-Chrome users may lack the same protections.
The compromise did not extend to the infrastructure of the affected domain owners themselves, and Google confirmed that certificate authorities complied with their standard requirements during the certificate issuance process. The incident represents another significant security breach involving unauthorized TLS certificates; a comparable incident occurred in 2011 when the Dutch certificate authority DigiNotar was compromised, resulting in forged certificates for Google.com and hundreds of other domains that were subsequently used to target approximately 300,000 individuals.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI