DNS Hijacks Affect Google Domains and Enable Unauthorized HTTPS Certificates

Summary

Hijacks of the .gh, .sl, and .as country-code domains let attackers alter DNS records and obtain unauthorized HTTPS certificates for Google and other organizations. Google blocked its affected certificates in Chrome and recommends monitoring CT logs and publishing stric

Key points

Attackers hijacked the .gh, .sl, and .as country-code domains and modified authoritative DNS records.
The attackers obtained unauthorized HTTPS certificates for several Google domains and domains belonging to other organizations.
Google says certificate authorities were not at fault given the nature of the attacks.
Google blocked the unauthorized certificates in Chrome and worked with issuing CAs to revoke them; it also alerted affected organizations where possible.
Google says some domains may remain affected.
Google advises domain owners to monitor Certificate Transparency logs, particularly for .gh, .sl, and .as domains, and publish restrictive CAA records after DNS control is restored.
Restrictive CAA policies can help prevent new certificate issuance using cached domain-control validation after a hijack ends.

Article Details

Victim Organization: Google
Incident Type: Hijacking of third-party ccTLDs involving modification of authoritative DNS records and unauthorized HTTPS certificate issuance for several Google domains and domains belonging to other organizations
Operational Impact: Google blocked the unauthorized certificates for its domains in Chrome and worked with issuing CAs to revoke them. Other organizations were also affected, and some domains might still have been affected.
Claim Status: confirmed

Vendors

GoogleGoogle has disclosed that several of its domains were affected by a recent hijack of third-party country-code top-level domains (ccTLDs).

Products

Google ChromeImmediately after learning of the incident, Google blocked the unauthorized certificates for its domains in Chrome and worked with the issuing CAs to revoke them.

Countries

American SamoaThe incident occurred last week and targeted the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs, putting all domains with those suffixes at risk.GhanaThe incident occurred last week and targeted the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs, putting all domains with those suffixes at risk.Sierra LeoneThe incident occurred last week and targeted the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs, putting all domains with those suffixes at risk.