Hackers hijack Google domains after breaching ccTLD registries

Threat actors breached third-party operators responsible for managing authoritative DNS records of the .GH, .AS, and .SL ccTLDs. By altering DNS records, they could request and obtain valid HTTPS certificates from certificate authorities for domains they did not own, including several Google domains and other organizations. This enabled domain hijacking and impersonation by redirecting visitors to attacker-controlled infrastructure. Google responded by blocking unauthorized certificates in Chrome using CRLSets, revoking certificates with CAs, and notifying affected organizations. The attack did not compromise Google's internal systems or indicate CA misbehavior. Google recommends monitoring Certificate Transparency logs and publishing restrictive CAA records to limit certificate issuance. The scope of affected domains may be larger than currently known, and protections are limited to Chrome users.

The attackers gained control over DNS records for certain ccTLDs, enabling them to obtain legitimate HTTPS certificates for domains they did not own. This allowed them to hijack domains and impersonate legitimate websites, potentially deceiving users and serving arbitrary content. While Google's own systems were not compromised, the incident affected multiple organizations' domains within the targeted ccTLDs. The fraudulent certificates were blocked in Chrome, protecting Chrome users, but users of other browsers may remain vulnerable. The incident exposes risks in third-party DNS registry security and certificate issuance validation processes.

Google has already revoked and blocked the unauthorized certificates in Chrome and worked with certificate authorities to revoke them. Chrome users are protected by these measures without needing to take action. Domain owners are urged to monitor Certificate Transparency logs for suspicious certificates and publish restrictive Certification Authority Authorization (CAA) DNS records to limit certificate issuance to authorized entities. However, CAA records cannot prevent certificate issuance during an active DNS hijack but help prevent further unauthorized certificates after DNS control is restored. Users of non-Chrome browsers may not be fully protected by these mitigations. Organizations should review their DNS registry security and certificate issuance monitoring practices.