Threat actors gained unauthorized access to the .gh, .sl, and .as country code top-level domains and leveraged this control to generate fraudulent TLS certificates for multiple organizations, according to an announcement from Google Tuesday.
By modifying authoritative DNS records within these compromised namespaces, the attackers were able to satisfy automated domain control validation processes required by certification authorities. This technique allowed them to obtain unauthorized certificates for several Google domains as well as “several leading global brands and widely used online services,” though Google did not publicly identify the other affected parties or specify which of its own domains were targeted.
TLS certificates serve as cryptographic credentials that establish the authenticity and encryption protections for websites and other internet infrastructure. Unauthorized possession of these certificates enables attackers to impersonate legitimate services at a cryptographic level, potentially allowing them to intercept communications or conduct phishing attacks. Google stated it worked with certification authorities to revoke the unauthorized credentials issued for its properties and deployed updated protections in Chrome to block identified counterfeit certificates.
While browser-level blocking measures have been implemented, Google cautioned that such interventions should not be considered a comprehensive defense. The company recommended that domain owners monitor certificate transparency logs for unexpected certificate issuance and implement restrictive Certification Authority Authorization DNS records to prevent future exploitation of similar vulnerabilities. Google also noted that the compromise did not extend to the infrastructure of the affected domain owners themselves and that certificate authorities complied with all applicable requirements during the issuance process.
The incident mirrors previous attacks on certificate authority infrastructure, including a 2011 breach of DigiNotar that resulted in fraudulent certificates for over 200 domains and affected approximately 300,000 users. Industry observers note that the slow and cumbersome certificate revocation process creates ongoing security risks when unauthorized credentials remain undiscovered.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI