Hackers Exploit Country-Code Domains, Steal Google HTTPS Certificates

Post Views: 7

Hackers compromised three country-code top-level domain (ccTLD) registries, leveraging access to acquire HTTPS certificates for Google and other high-profile organizations.

Attack Details

Hackers targeted third-party administrators of the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) registries, exposing all domains under these extensions to potential manipulation. Threat actors altered authoritative DNS records for affected domains, creating a pathway to obtain digital certificates.

Google’s Clarification

Google clarified that its internal systems were not breached during the incident, stating, “These incidents did not involve a compromise of Google’s systems.” The company also noted that no evidence suggested the certificate authorities (CAs) issuing the affected certificates acted improperly.

Detection and Scope

Google became aware of the breaches in the preceding week but did not disclose the method of compromise, the perpetrators, or the timeline of the attacks. Unauthorized certificates were detected through Chrome’s Certificate Transparency (CT) logs, revealing additional organizations impacted by the same attack vector. These included major global brands and widely used online services.

Mitigations and Browser Protections

Google implemented browser-specific mitigations by blocking invalid certificates via CRLSets, a mechanism used to enforce certificate revocation. Affected entities were notified where possible, though the company emphasized that browser-based protections alone are insufficient. “Chrome users do not need to take any action to be protected,” Google stated, while cautioning that other browsers lack equivalent safeguards.

Limitations and Future Plans

Google acknowledged the limitations of its analysis, noting, “We cannot guarantee that our analysis identified every affected domain.” To address systemic risks, the company outlined plans to collaborate with the broader cybersecurity community on mitigating DNS and routing vulnerabilities. These efforts include reducing certificate validity periods and minimizing reliance on domain control validation (DCV) reuse.

Expert Recommendations

Cybersecurity experts advise organizations to monitor certificate issuance patterns and implement robust DNS monitoring tools to detect anomalies. As threat actors increasingly exploit infrastructure weaknesses, proactive measures remain essential to safeguarding digital assets.

“Chrome users do not need to take any action to be protected,” Google stated, while cautioning that other browsers lack equivalent safeguards.

Long-Term Improvements

Google’s initiatives, including the Chrome Root Program and the newly launched Chrome Quantum-resistant Root Program, aim to enhance cryptographic resilience against emerging threats. These efforts underscore the critical role of domain registry security in maintaining internet trust.