Breaches and incidents
.gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) ccTLDs hijacked to obtain HTTPS certificates for Google domains
Google said attackers “compromised the third-party ccTLDs”, modified authoritative DNS records and obtained unauthorized HTTPS certificates for several...
- Disclosed
- Verification
- Checked against a primary source
What happened
- Google said attackers “compromised the third-party ccTLDs”, modified authoritative DNS records and obtained unauthorized HTTPS certificates for several Google domains; CT data also showed “several leading global brands and widely used online services” were likely affected. The Hacker News counted 12 certificates for seven domains (11 from Let’s Encrypt, one from ZeroSSL), logged on 22 Sep (.gh), 25 Sep (.sl) and 27 Sep (.as), and says the total “may be higher”.
- Root cause: how the ccTLD operators were compromised is not disclosed; Google says it has “no reason to believe” the CAs acted improperly and “These incidents did not involve a compromise of Google’s systems.”
- No attacker named. Google has not said whether any certificate was used to impersonate a site.
- Chrome blocked the certificates via CRLSets and Google worked with the CAs to revoke them (Cert Spotter, per THN: revoked 26 Sep and 1 Oct); Chrome users need take no action.