Google says hackers used hijacked domains to obtain certificates for major services

Google says attackers hijacked three country-code top-level domains and used them to obtain HTTPS certificates covering Google domains and websites run by other organizations. The company said thousands of websites were put at risk, and that all certificates used in the attacks have since been blocked.

The hijacked domains were .gh for Ghana, .sl for Sierra Leone and .as for American Samoa. Attackers changed authoritative DNS records, which let them obtain certificates for the domains. Google said the activity affected “several leading global brands and widely used online services,” but did not identify the organizations or say how many were affected.

Google blocked unauthorized certificates for its properties in Chrome using CRLSets and worked with the issuing certificate authorities to revoke them. It said it had no reason to believe the authorities had acted improperly. Google cautioned that its actions might not have identified every affected domain or protected users of other browsers.

The company said Chrome users did not need to take action. It advised domain owners to monitor Certificate Transparency and publish restrictive CAA records with ACME account bindings.

The incident recalls earlier certificate failures. In 2011, attackers compromised Dutch certificate authority DigiNotar and generated 531 fraudulent certificates for domains including those of Google, Microsoft, Mozilla and Skype. Google also cited a separate 2011 theft of an account linked to Comodo that led to nine fraudulent certificates, and a 2015 discovery of an unauthorized certificate issued by Thawte during internal testing.

Google said it would continue working on HTTPS improvements, including reducing certificate validity and DCV reuse through the Chrome Root Program and the Chrome Quantum-resistant Root Program.