Attackers hijacked several Google domains and obtained unauthorized HTTPS certificates after compromising third-party domain operators. The Google domain hijacking incidents affected country-code domains for Ghana, Sierra Leone and American Samoa.
Other organizations also suffered domain hijacks within the .GH, .SL and .AS namespaces. However, Google said the attacks did not compromise its own systems.
The attackers manipulated authoritative DNS records, allowing them to redirect affected domains to infrastructure under their control.
DNS Control Allowed Attackers to Impersonate Websites
DNS records direct visitors to the servers associated with a domain. By changing those records, attackers could send people visiting legitimate addresses to their own infrastructure.
That access also helped them obtain valid HTTPS certificates for domains they did not own.
Certificate authorities verify domain control before issuing certificates. One common method requires the requester to publish a DNS TXT record containing a value supplied by the authority.
Because the attackers controlled the relevant DNS records, they could satisfy that verification process. Consequently, they could impersonate legitimate brands and display their own content through affected domains.
Google said it had no reason to believe the certificate authorities involved had acted improperly.
Google Blocked Certificates and Sought Revocation
In response to the Google domain hijacking incidents, the company blocked unauthorized certificates for its properties in Chrome using CRLSets.
This emergency mechanism lets Chrome quickly reject selected revoked or untrusted HTTPS certificates. Google also worked with the issuing authorities to revoke the certificates, extending protection beyond Chrome’s own blocking system.
Meanwhile, an examination of Certificate Transparency logs revealed additional certificates apparently connected to the attacks.
Those findings pointed to other affected organizations, including major global brands and widely used online services. Google subsequently blocked the suspicious certificates in Chrome and notified organizations where possible.
Chrome Protection May Not Cover Every Affected Domain
Chrome users do not need to take action to receive the protections Google introduced for this incident.
However, the company cautioned that its investigation may not have identified every affected domain. Its certificate blocks therefore might not cover the full scope of the attacks.
Furthermore, CRLSets protects Chrome users specifically. People using other browsers cannot assume that Chrome’s interventions also protect their browsing sessions.
Certificate revocation provides a separate response, but Google warned against treating its Chrome measures as universal protection.
Domain Owners Should Monitor Certificate Issuance
Google urged organizations to monitor Certificate Transparency logs across their complete domain portfolios. This includes parked domains, which still require oversight despite lacking an active website.
It also recommended restrictive Certification Authority Authorization records where appropriate. These DNS records can limit certificate issuance to authorized ACME accounts and specified validation methods.
However, CAA records cannot prevent unauthorized issuance while attackers actively control DNS.
Their value also extends to recovery. After an owner restores legitimate DNS control, restrictive settings can prevent attackers from obtaining additional certificates through cached domain validation.
Google did not identify the attackers or disclose the total number of unauthorized certificates involved.
0 responses to “Google Domain Hijacking Linked to Breaches at Country-Code Registries”