Hijacked .gh, .sl and .as registries handed attackers HTTPS certificates for Google domains

Attackers who took control of three country-code top-level domains used that access to obtain HTTPS certificates for several Google domains and for domains run by other large organizations, Google disclosed on Tuesday.

Attackers compromised the third-party operators of the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) ccTLDs, putting every domain under those endings at risk, and then changed the authoritative DNS records.

"These incidents did not involve a compromise of Google's systems," the company said.

"Chrome users do not need to take any action to be protected," Google wrote.

Google learned of the hijacks last week and did not say how the registries were compromised, who is behind the attacks, or when they began.

Google warned that browser-side blocking should not be the only line of defense and said that, due to the complexity of DNS hijacks, "we cannot guarantee that our analysis identified every affected domain."

Google noted that Chrome's interventions do not reliably protect people using other browsers.

"To keep our users safe, we are committed to long-term HTTPS ecosystem improvements, such as reducing certificate validity and DCV reuse, through the Chrome Root Program and the new Chrome Quantum-resistant Root Program," the company concluded.

Google plans to keep working with the wider community to limit the damage that DNS and routing compromises can cause.

The certificates were issued on the strength of the attackers' control of the authoritative DNS records, with no CA error involved, according to Google's account.

Outside Chrome, protection rests on CA revocation, and certificates for any affected domain Google's analysis missed are neither blocked in Chrome nor revoked.

Both measures Google named act on time limits: how long a certificate stays valid and how long an earlier domain control check can be reused.

Google and the other affected organisations had certificates obtained for their names through third-party registry operators they do not run; an organisation's domain-validated certificates depend on every registry it holds names under, and a breach at one exposes the names there.

Three separate registry operators were compromised in one set of incidents, so the point of entry was the registry operators, not the individual brands.