Attackers Hijack Three ccTLD Operators to Obtain Unauthorized HTTPS Certificates
Summary
Attackers compromised the .gh, .sl, and .as registry operators, changed DNS records, and obtained unauthorized certificates for Google and other organizations. Google blocked its certificates in Chrome and helped revoke them; other affected domains may remain undiscover
Key points
- Attackers compromised the operators of the .gh, .sl, and .as ccTLDs and altered authoritative DNS records.
- The hijacked DNS records enabled attackers to obtain unauthorized HTTPS certificates for Google domains and other organizations.
- Google said its own systems were not compromised and did not identify who was responsible or when the attacks began.
- Google blocked certificates for its properties in Chrome using CRLSets and worked with issuing CAs to revoke them.
- Certificate Transparency logs indicated that other large organizations and online services may also have been affected.
- Google warned that its analysis may not have identified every affected domain and that Chrome’s blocking does not reliably protect users of other browsers.
Article Details
- Victim Organization
- Unknown
- Victim Domain
- Unknown
- Incident Type
- Compromise of three ccTLD operators and DNS hijacking to obtain unauthorized HTTPS certificates
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Authoritative DNS records under .gh, .sl, and .as were changed. Unauthorized certificates were issued for Google domains and domains of other organizations. Google blocked certificates for its properties in Chrome and worked with issuing CAs to revoke affected certificates; other organizations' certificates were also blocked in Chrome where identified.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Products
Chrome Quantum-resistant Root Programreducing certificate validity and DCV reuse, through the Chrome Root Program and the new Chrome Quantum-resistant Root Program,” the company concluded.Chrome Root ProgramHTTPS ecosystem improvements, such as reducing certificate validity and DCV reuse, through the Chrome Root Program and the new Chrome Quantum-resistant Root Program,” the company concluded.CRLSets#GoogleGoogle ChromeGoogle revoked the unauthorized certificates, blocked them in Chrome, and worked with Certificate Authorities to protect users while warning that more affected domains may exist.
Countries
American SamoaAttackers compromised the third-party operators of the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) ccTLDs, putting every domain under those endings at risk, and then changed the authoritative DNS records.GhanaAttackers compromised the third-party operators of the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) ccTLDs, putting every domain under those endings at risk, and then changed the authoritative DNS records.Sierra LeoneAttackers compromised the third-party operators of the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) ccTLDs, putting every domain under those endings at risk, and then changed the authoritative DNS records.