Hackers Hijacked Three ccTLDs to Obtain Certificates for Google Domains

Hackers successfully hijacked three country-code top-level domains (ccTLDs) and used the compromise to obtain HTTPS certificates for several Google domains, according to a report by SecurityWeek. The incident highlights a significant breach in the trust infrastructure that underpins secure web communications.

The attackers targeted the .gh, .sl, and .as ccTLDs. By gaining control over these registries, the threat actors were able to issue valid HTTPS certificates for various Google-owned domains. This capability allows for the potential interception of encrypted traffic or the creation of convincing phishing sites that appear legitimate to browser security checks.

Context and Background

Country-code top-level domains are the highest level of the Domain Name System hierarchy, assigned to specific countries or territories. The .gh domain represents Ghana, .sl represents Sierra Leone, and .as represents American Samoa. Compromising a ccTLD registry is a severe security event because it grants the attacker authority over all domains registered under that extension.

SecurityWeek reported that the hijacks resulted in the issuance of certificates for Google domains. This suggests that the attackers exploited vulnerabilities or credentials within the registry management systems of these specific ccTLDs. The ability to generate valid certificates for major tech companies like Google indicates a sophisticated attack vector that bypasses standard certificate authority validation processes for those specific domains.

Who Is Affected

Google is the primary entity identified as being impacted by this incident, with several of its domains receiving hijacked certificates. The compromise of the .gh, .sl, and .as registries also affects any other organizations or individuals who hold domains under these extensions, as the integrity of the entire registry is called into question.

Users of Google services may face risks if the hijacked certificates are used for man-in-the-middle attacks or phishing campaigns. Although browsers typically warn users about certificate issues, a valid certificate issued through a compromised registry can bypass these warnings, making malicious sites appear trustworthy. The broader internet community is also affected, as trust in the Public Key Infrastructure (PKI) relies on the security of these root-level registries.

What should you do?

Security professionals and IT administrators should monitor for unusual certificate activities on their domains, especially those under the affected ccTLDs. Organizations should verify the integrity of their own certificate chains and ensure that their web browsers and security tools are up to date to detect any anomalies.

What to do and how to stay safe: Google

• Monitor certificate transparency logs for any unauthorized certificate issuances related to your organization's domains.
• Verify the authenticity of HTTPS connections to critical services, paying close attention to certificate details and issuer information.
• Review access logs for registry management systems if you administer domains under .gh, .sl, or .as to detect unauthorized changes.
• Educate users on the signs of potential phishing, such as unexpected login requests or unusual URL structures, even if the site appears secure.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which ccTLDs were hijacked?

The .gh, .sl, and .as country-code top-level domains were hijacked by attackers.

Which company was impacted?

Google was impacted, with several of its domains receiving hijacked HTTPS certificates.

What did the attackers do with the hijacked domains?

The attackers used the compromised ccTLDs to obtain HTTPS certificates for various Google domains.