Science & Tech · Cybersecurity · 2 days ago
Hijacks of Three Country-Code Domains Expose Google and Other Sites
Attackers hijacked parts of the .gh, .sl and .as country-code domain systems, linked to Ghana, Sierra Leone and American Samoa.
They changed authoritative DNS records, which can help them pass checks used to issue HTTPS certificates.
The certificates covered several Google domains and sites run by other organizations.
Google said its own systems were not compromised and that it had no reason to believe certificate authorities acted improperly.
Chrome blocked certificates Google identified, and the company worked with the issuers to revoke them.
Google said other organizations were also affected, but did not name them or say how many certificates were obtained.
The incident shows that control of DNS infrastructure can put websites at risk without breaking into their systems.
Google advises domain owners to monitor certificate logs and use restrictive CAA records; it also plans broader changes to HTTPS certificate practices.
Attackers hijacked the .gh, .sl and .as country-code domain namespaces and obtained unauthorized HTTPS certificates for several Google domains and other organizations’ sites.
The attackers changed authoritative DNS records, putting domains under the three suffixes at risk.
Google said its own systems were not compromised and said it had no reason to believe certificate authorities acted improperly.
Google blocked unauthorized certificates for its properties in Chrome and worked with the issuing certificate authorities to revoke them.
Google said other organizations may still be affected and urged domain owners to monitor certificate logs and use restrictive CAA records.
- Who
- Attackers hijacked the .gh, .sl and .as namespaces; Google and other organizations had domains covered by unauthorized certificates.
- What
- The attackers changed authoritative DNS records and obtained unauthorized HTTPS certificates for several Google domains and other sites.
- When
- The incidents occurred last week, according to Google. Its Chrome team published a post about them on October 6.
- Where
- The affected namespaces were .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa).
- Why
- Not stated
This story does not have two clearly opposing sides.
During these hijacks, attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains, as well as domains belonging to other organizations,
To ensure users of those sites were kept safe as soon as possible, we proactively blocked these certificates in Chrome. Where possible, we reached out to impacted organizations to alert them to our findings and actions,
Attackers hijacked the .gh, .sl and .as namespaces and changed authoritative DNS records.
Google's Chrome Secure Web and Networking Team published a post about the incidents.
Google blocked unauthorized certificates in Chrome and worked with issuing certificate authorities to revoke them.
- Affected namespaces
- .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa)
- Google domains
- Several covered by unauthorized HTTPS certificates
- Other organizations
- Additional affected organizations identified through Certificate Transparency logs
- Chrome response
- Unauthorized certificates for Google properties blocked through CRLSets
- Recommended safeguard
- Monitor Certificate Transparency logs and restore restrictive CAA records
Sources
Related news
AI security patches often stop crashes but fail maintainers’ tests
Phone settings can help block spam calls and scam texts
Yandex services disrupted after Ukrainian drone strikes on Russian data centers
US seizes two China-linked hacking tools used against critical infrastructure
Dropbox launches data access governance tool in Singapore
Anthropic offers free AI vulnerability scans to open-source projects
FBI arrests another suspect linked to ShinyHunters jobs-site breach
Canadian cybersecurity negotiator arrested in ShinyHunters investigation
Canadian cybersecurity executive arrested on extortion-related charges
Canadian cybersecurity executive arrested in U.S. hacking case
New characters let lookalike domains bypass some browser checks
