Attackers hijacked three country code top-level domains—.gh,.sl, and.as—to create unauthorized TLS certificates for Google and several other global organizations, Google disclosed on Tuesday. The perpetrators manipulated authoritative DNS records within these namespaces, bypassing automated domain control validation checks and obtaining fraudulent x.509 certificates that bind domain names to public keys.
Possession of an unauthorized certificate enables cryptographic impersonation of the affected infrastructure. Google responded by updating Chrome to block the identified unauthorized credentials and worked with certification authorities to revoke the fraudulent certificates issued for its own properties.
But Google cautioned that browser-side protections alone are insufficient. The company stated: "browser-side intervention should not be relied on to protect your users," citing the complexity of DNS hijacks and the inability to guarantee identification of every affected domain.
Google advises domain owners to monitor certificate transparency logs for unexpected certificate issuance and to publish restrictive Certification Authority Authorization (CAA) DNS records. CAA records can prevent attackers from reusing cached validation data after DNS control is restored.
The incident exposes vulnerabilities at the ccTLD level that can undermine the foundational trust mechanisms of the internet. Google did not specify which of its domains were affected or name the other brands targeted. The attack across three distinct ccTLDs suggests a coordinated effort to exploit systemic weaknesses in domain validation.
Certificate revocation through official channels is often slow. While browser makers have developed quicker methods to block specific certificates, any undiscovered certificates continue to pose a threat to users and the integrity of online services.
