Hackers hijack Google domains after breaching ccTLD registries

Attackers hijacked domains in the country-code top-level domains (ccTLDs) for Ghana (.GH), Sierra Leone (.SL) and American Samoa (.AS) after compromising third-party operators and changing authoritative DNS records, according to Google and BleepingComputer.

The attackers used control of DNS records to redirect affected domains to infrastructure they controlled and obtain valid HTTPS certificates. That could let them impersonate brands and serve arbitrary content. The incident also led to unauthorized certificates for several Google domains, but Google said its own systems were not compromised.

Google blocked certificates for its properties in Chrome using CRLSets, an emergency mechanism for blocking selected revoked or untrusted certificates, and worked with the issuing authorities to revoke them. After reviewing Certificate Transparency logs, it blocked additional certificates believed to be connected to the attacks and notified affected organizations where possible.

Google said it could not guarantee that it had identified every affected domain. It also noted that Chrome interventions do not reliably protect users of other browsers. The company said Certification Authority Authorization (CAA) DNS records cannot prevent certificate issuance during an active DNS hijack, but can prevent additional certificates from being obtained using cached domain validation after legitimate DNS control is restored.

The announcement did not identify the attackers or say how many certificates were confirmed hijacked.