Attackers hijacked three top-level domains and used that control to mint counterfeit TLS certificates for Google and several other major brands, Google said Tuesday, as reported by Ars Technica. The attacks targeted the .gh, .sl and .as country-code domains and modified the authoritative DNS records of selected websites inside those namespaces — enough to pass the automated checks that certificate authorities use to confirm who owns a domain.
TLS certificates are the cryptographic credentials that prove a website is really who it claims to be and keep the connection encrypted. With unauthorized certificates in hand, attackers can impersonate a site's infrastructure and make a forged page look legitimate to browsers. Google says it has updated Chrome to block the certificates it identified as unauthorized, and has worked with the issuing authorities to get the fake certificates for Google properties revoked.
How the domain hijack worked
According to Google, the attackers took control of the three country-code top-level domains and then rewrote authoritative DNS records and nameserver delegations for a chosen list of domains. That control let them change the IP addresses of the targeted websites, send and receive traffic on them, and satisfy the industry validation checks that normally require an applicant to prove they control a domain.
Google did not name the specific Google domains that were affected, nor did it identify the other organizations whose domains were hit. It described them only as "several leading global brands and widely used online services." It is also not clear how many unauthorized certificates were issued, or whether every one of them has now been blocked.
The company stressed that the incident did not involve a compromise of the affected domain owners' own infrastructure, and that the certificate authorities followed all required procedures. The weakness was in the domain registration layer, not in the servers of the brands that were impersonated.
