Google confirmed that several of its domains were caught up in a recent hijacking of three country-code top-level domains — .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). Attackers compromised the third-party registries behind them in late September, modified authoritative DNS records, and obtained unauthorized HTTPS certificates for Google and other organizations’ domains. Every domain ending in those suffixes was at risk, though Google says its own systems were never breached.
Google quickly blocked the rogue certificates for its own domains in Chrome and worked with certificate authorities to revoke them. Certificate Transparency (CT) log analysis turned up other global brands and popular services in the same position, and the company blocked those certificates too. The CAs aren’t at fault, Google says, given how the attacks worked. How attackers reached the registries, who ran the campaign, and when it started are all still unanswered.
Some domains may still be at risk. Domain owners should monitor CT logs across their whole portfolio, including parked and regional ccTLD names, and review recent entries for certificates they never requested. Restrictive CAA DNS records are worth publishing once DNS control is back. CAA can’t stop issuance during a live hijack, but CAs may reuse a cached domain validation check to mint fresh certificates after one ends, and a restrictive policy closes that door.
Source: SecurityWeek
