Hackers obtain counterfeit TLS certificates for Google and other large services by hijacking ccTLDs

Attackers compromised three country-code top-level domains—.gh, .sl, and .as—and used their control to mint unauthorized TLS certificates for Google and other large organizations, Google said in an advisory on Tuesday. By modifying authoritative DNS records within the hijacked namespaces, the attackers were able to pass automated domain control validation checks and obtain unauthorized certificates for “several Google domains” and “several leading global brands and widely used online services.”

Google said it updated Chrome to block all certificates it identified as unauthorized and worked with issuing certificate authorities to ensure the unauthorized certificates for Google properties were revoked. The company did not identify the affected Google domains or name other affected organizations, and it remains unclear how many unauthorized certificates were issued or whether all non-Google certificates have been blocked.

The incident did not involve compromise of the infrastructure of any affected domain owners, Google said. Instead, attackers leveraged control of the three ccTLDs to change IP addresses for selected websites and modify authoritative DNS records and nameserver delegations, enabling them to pass validation checks that require proof of domain control.

Google cautioned that browser-side interventions should not be relied upon to protect users, noting that Chrome’s blocking measures do not reliably protect non-Chrome users and that undiscovered certificates may still pose a threat. The company advised domain owners to monitor certificate transparency logs for unexpected issuance across their domains and to publish restrictive Certification Authority Authorization (CAA) DNS records to prevent attackers from reusing cached validation data after DNS control is restored.

This is not the first time unauthorized certificates have been obtained by attackers. Google pointed to the 2011 breach of Netherlands-based certificate authority DigiNotar, in which attackers minted counterfeit certificates for Google.com and more than 200 other domains, which were later used in targeted attacks against at least 300,000 users with ties to Iran.