DNS Infrastructure Hijacked to Obtain Unauthorized Certificates for Google and Other Domains

Summary

Attackers compromised infrastructure behind .gh, .sl, and .as domains to obtain unauthorized HTTPS certificates. Google blocked suspicious certificates in Chrome and worked with certificate authorities to revoke them.

Key points

Attackers manipulated DNS infrastructure behind the .gh, .sl, and .as namespaces to pass domain-control checks and obtain valid HTTPS certificates.
The compromise did not break encryption or compromise Google’s systems; control of DNS enabled certificate issuance for domains the attackers did not legitimately control.
With traffic redirection to attacker-controlled servers, the certificates could support convincing impersonation of legitimate services.
Google blocked unauthorized certificates for its properties in Chrome, worked with certificate authorities to revoke them, and later blocked suspicious certificates for other organizations.
Google cautioned that its analysis may not identify every affected domain and Chrome interventions do not reliably protect users of other browsers.
Users should heed certificate warnings, check provider notices before sensitive activity on services using these domain endings, and verify unusual requests through a separate trusted channel.
Long-term remediation depends on domain operators restoring control and preventing or revoking unauthorized certificates.

Article Details

Event Type: Attackers compromised infrastructure behind the .gh, .sl, and .as country-code domain namespaces to obtain unauthorized HTTPS certificates for Google domains and other organizations.
Impact: The unauthorized certificates, combined with traffic redirection, could enable convincing impersonation of legitimate services. Google blocked suspicious certificates in Chrome and worked with certificate authorities to revoke them; Google said its analysis may not have identified every affected domain, and Chrome interventions may not protect non-Chrome users.

Vendors

GoogleAccording to Google, attackers compromised infrastructure behind three country-code domain namespaces—.gh (Ghana), .sl (Sierra Leone), and .as (American Samoa)—and used it to obtain unauthorized HTTPS certificates for

Products

Google ChromeGoogle initially blocked unauthorized certificates for its own properties in Chrome and worked with the issuing certificate authorities to revoke them. It later blocked suspicious certificates for other organizations in

Countries

American Samoainfrastructure behind three country-code domain namespaces—.gh (Ghana), .sl (Sierra Leone), and .as (American Samoa)—and used it to obtain unauthorized HTTPS certificates for Google domains and other organizations.GhanaAccording to Google, attackers compromised infrastructure behind three country-code domain namespaces—.gh (Ghana), .sl (Sierra Leone), and .as (American Samoa)—and used it to obtain unauthorized HTTPS certificates for Sierra Leoneattackers compromised infrastructure behind three country-code domain namespaces—.gh (Ghana), .sl (Sierra Leone), and .as (American Samoa)—and used it to obtain unauthorized HTTPS certificates for Google domains