A series of coordinated attacks targeting the .gh, .sl, and .as country code top-level domains resulted in the issuance of unauthorized TLS certificates for multiple organizations, Google disclosed Tuesday. The attackers gained control of authoritative DNS records within these domains and exploited that access to pass automated validation procedures required by certificate authorities to issue credentials.
TLS certificates function as cryptographic credentials that authenticate websites and other internet infrastructure by binding domain names to public keys. Unauthorized possession of these certificates enables attackers to impersonate legitimate services and intercept communications. Google reported that the unauthorized certificates covered several of its own domains as well as domains belonging to multiple other prominent global brands and widely used online services, though the company did not publicly identify the affected organizations.
Google implemented a two-pronged response to the incident. The company updated its Chrome browser to identify and block the unauthorized certificates and coordinated with the issuing certificate authorities to revoke credentials associated with Google properties. However, Google emphasized that Chrome users should not view browser-level protections as a complete defense against such threats. The company advised domain owners to monitor certificate transparency logs for unexpected issuance events and to deploy restrictive Certification Authority Authorization DNS records as preventive measures.
The incident involved attackers modifying DNS records and nameserver delegations to demonstrate domain control during the certificate application process, but did not compromise the infrastructure of the affected domain owners themselves. Google noted that certificate authorities adhered to all requirements during issuance. The organization cautioned that undiscovered unauthorized certificates remain a potential risk and that revocation through official channels can be a slow process, necessitating faster browser-based interventions.
Unauthorized certificate issuance has affected internet security on previous occasions. A 2011 compromise of Dutch certificate authority DigiNotar resulted in forged credentials for Google.com and over 200 additional high-traffic sites, which were subsequently used against approximately 300,000 individuals in Iran. Similar incidents have occurred with varying frequency since that time.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI