Google Domains Impacted by Recent ccTLD Hijacks

Attackers compromised control over the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs, enabling them to modify DNS records and obtain unauthorized HTTPS certificates for Google domains and others. Google identified the unauthorized certificates via Certificate Transparency logs, blocked them in Chrome, and collaborated with issuing certificate authorities to revoke them. The certificate authorities were not at fault due to the nature of the attack. Google advises domain owners to monitor CT logs and publish restrictive CAA DNS records to mitigate risks from cached domain control validation states after DNS control is restored.

Unauthorized modification of DNS records for the affected ccTLDs allowed attackers to obtain fraudulent HTTPS certificates for Google domains and other organizations, potentially enabling man-in-the-middle or impersonation attacks. Google mitigated the risk by blocking the certificates in Chrome and revoking them with certificate authorities. However, some domains might still be affected if domain owners have not yet restored DNS control or implemented protective DNS policies. The incident affects all domains under the compromised ccTLDs (.gh, .sl, .as).

Google has blocked the unauthorized certificates in Chrome and worked with certificate authorities to revoke them. Domain owners under the affected ccTLDs should monitor Certificate Transparency logs for unauthorized certificates and publish restrictive CAA DNS records to limit certificate issuance to authorized entities. Restoring restrictive CAA policies is critical to prevent attackers from exploiting cached domain control validation states after DNS control is regained. No further immediate action is required from end users, as Google has taken proactive steps to mitigate the threat.