Hijacked Country Domains Let Attackers Mint Fake Certificates for Google and Major Brands
Google says attackers seized control of the .gh, .sl and .as domain registries and used it to obtain unauthorized TLS certificates. Here is how it happened and what domain owners should do.
The padlock in a browser’s address bar rests on one promise: the certificate behind it was issued to whoever really controls that domain. This week Google described an attack that broke that promise without breaching a single website or certificate authority.
Going after the registries
According to Google, attackers compromised three country-code top-level domains: .gh, .sl and .as. With control at the registry level, they rewrote authoritative DNS records and nameserver delegations for a chosen set of domains under those extensions. That let them send and receive traffic for those names.
That was enough to fool the system. Certificate authorities check domain control automatically, and the attackers could now pass those checks. The result was unauthorized TLS certificates for several Google domains and for what Google called several leading global brands and widely used online services. Google says the affected domain owners’ own infrastructure was not compromised, and the certificate authorities followed the rules.
The cleanup, and its limits
Google says it updated Chrome to block every unauthorized certificate it identified, and worked with the issuing authorities to get the certificates for Google properties revoked. It has not named the affected Google domains or the other organizations. It is also unclear how many certificates were issued in total.
Google itself warns that this is not the end of the story. DNS hijacks are complex, so it cannot guarantee it found every affected domain, and Chrome’s blocks do nothing for people using other browsers. Any certificate nobody has found yet is still a live risk.
A familiar weak point
Forged certificates are not new. In 2011, attackers who broke into the Dutch certificate authority DigiNotar issued fake certificates for Google.com and more than 200 other popular domains. Those certificates were used against at least 300,000 people with ties to Iran. What stands out this time is the route: the registries above the domains, not the certificate authorities.
Dan Goodin laid out Google’s findings for Ars Technica, which is worth reading for the technical background on how certificates bind domains to keys.
What this means for your company
- Watch certificate transparency logs. Google recommends monitoring them for unexpected certificates on your domains. Free and paid monitoring services can email you when a new certificate appears.
- Publish CAA records. Google advises restrictive Certification Authority Authorization DNS records, which limit which authorities may issue for your domain and help stop reuse of cached validation data after DNS control is restored.
- Know your domain chain. Write down who your registrar is, which extension your domains use, and who can change DNS. If you rely on a less common country-code domain, be aware that the registry’s security is part of yours.
- Don’t lean on the browser alone. Staff on different browsers or apps may not get the same protection, so domain monitoring belongs on your own to-do list.
Need help setting up certificate monitoring and tightening DNS controls for your domains? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
