Emerging ThreatsMalware & Ransomware

Google Certificates Targeted in ccTLD Hijacks

Analyst 207||Source: InfoSecMag
Technicians work in a server room with rows of equipment and computer screens displaying abstract content.

"Chrome responded by blocking the unauthorized certificates for Google properties through CRLSets, the mechanism Chrome uses to quickly block certificates in emergencies." — Google Chrome Secure Web and Networking Team, October 6

Which ccTLDs were hijacked

Attackers compromised three country-code top-level domain registries and used that control to obtain unauthorized HTTPS certificates for several Google domains and for sites belonging to other organizations, Google said in a post published by its Chrome Secure Web and Networking Team on October 6. The incidents affected the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) namespaces after attackers modified authoritative Domain Name System (DNS) records for those ccTLDs.

How DNS control created certificate risk

Google described a straightforward path from DNS hijack to certificate issuance: by controlling authoritative DNS records, attackers can interfere with the domain-control validation process that certificate authorities (CAs) use when issuing certificates. The incidents illustrate that a compromise of DNS infrastructure can affect HTTPS trust without directly breaching a website's own systems.

Google and Chrome's immediate technical response

Chrome used CRLSets — its emergency mechanism for quickly blocking certificates — to block the unauthorized certificates for impacted Google properties. Google said it worked with the issuing CAs to revoke the certificates so that users of other clients would be protected. Certificate Transparency (CT) logs then revealed additional organizations that Google believed had been affected; Google proactively blocked those certificates in Chrome and said it contacted affected organizations where possible. Google also stated it had no reason to believe the CAs that issued the affected certificates had acted improperly, and that the incidents did not involve a compromise of Google's own systems.

Limits of browser-side mitigation and Google’s ecosystem recommendations

Google warned browser-side blocking should not be relied upon as a complete defense because its analysis may not have identified every affected domain and because Chrome's interventions do not reliably protect non‑Chrome users. To reduce future risk, Google recommended that domain owners continuously monitor CT logs across their entire domain portfolios, including parked and regional ccTLD properties, and that organizations operating .gh, .sl or .as domains review recent CT entries for unexpected certificate issuance.

Google also recommended the use of restrictive Certification Authority Authorization (CAA) records combined with Automatic Certificate Management Environment (ACME) account bindings. The company noted that while a restrictive CAA policy cannot prevent certificate issuance during an active DNS hijack, restoring such a policy afterward prevents attackers from reusing cached domain-control validation checks to obtain new certificates. Google said it will continue working on broader HTTPS ecosystem changes, including reducing certificate validity periods and the reuse of domain-control validation.

How technologists, affected enterprises, and end users should view this incident

  • Technologists and security teams: Google’s post calls for continuous monitoring of CT logs across entire domain portfolios, including parked and regional ccTLD properties, and for implementing restrictive CAA records with ACME account bindings to limit reuse of cached validation after a DNS incident.
  • Affected enterprises and procurement leaders: Several leading global brands and widely used online services were identified in CT logs as potentially affected; Google said it proactively blocked those certificates in Chrome and contacted affected organizations where possible, but did not identify them or disclose how many certificates were obtained.
  • End users and browser operators: Chrome’s CRLSet blocking will protect Chrome users for the certificates Google identified, but Google warned this protection is not comprehensive and does not reliably protect users of other clients.

The incidents are a reminder that trust in HTTPS rests on layers — DNS, certificate issuance, and client-side validation — and that compromise at any one layer can produce real-world risk without touching a site’s application stack. Google’s combination of emergency blocking, CA revocations, CT monitoring, and recommendations for CAA/ACME controls addresses immediate exposure while pointing to longer-term changes it says the ecosystem needs, including shorter certificate validity and curbing the reuse of domain-control validation. Whether those broader changes can reduce the attack surface exposed by DNS compromises remains the next technical and operational question.

https://www.infosecurity-magazine.com/news/attackers-hijack-cctlds-obtain/

Emerging ThreatsGoogleNetwork SecurityWeb SecurityHTTPSCertificate HijackingDNSDomain Name SystemCctld
Related Intelligence

Continue Reading

GenAI Fuels Phishing Evolution, Prompting New Security Countermeasures

GenAI Fuels Phishing Evolution, Prompting New Security Countermeasures

Thanks to AI, phishing emails have become a whole lot harder to spot - gone are the telltale signs of poor grammar and misspelt words, replaced with slick, error-free language that's almost indistinguishable from the real thing. Phishing has evolved into a massive threat, with the FBI reporting a 274% surge in losses over just two years.

Analyst 207
Blurred computer screen and employees in background of ASOS office login area.

ASOS Breach Exposes Customer Data After Stolen Credentials Used

ASOS recently suffered a data breach when an attacker impersonated a trusted contact to steal employee login credentials, which were then used to access sensitive customer information on third-party platforms. The breach highlights the importance of protecting sensitive data and preventing unauthorized access.

Analyst 207
Hospital corridor with staff, patient rooms, and a laptop on a medical cart.

Healthcare Breach Exposes 20 Million Patient Records

A recent healthcare breach has put 20 million patient records at risk, highlighting the vulnerabilities that can arise during cloud migrations - especially when sensitive data is left exposed on servers. Even with the best intentions, a single misstep can leave patients' personal and medical information in the wrong hands.

Analyst 207
Modern computer security research facility with a laptop workstation surrounded by papers, books, and technical devices.

Russia-Aligned UAC-0099 Refines MATCHBOIL Malware

The operators of UAC-0099, a group likely aligned with Russian interests, have been steadily refining their MATCHBOIL malware, making it a more potent tool for future attacks. This deliberate evolution shows a clear intent to evade detection and enhance the malware's flexibility.

Analyst 207