Unauthorized HTTPS certificates for multiple Google properties were obtained by attackers who first breached third-party operators managing country-code top-level domains (ccTLDs) and altered authoritative DNS records. The compromise affected domains registered under .GH, .SL, and .AS, along with properties belonging to other organizations in those registries.

Google stated that "the attacks affected domains of other organizations in the .GH, .SL, and .AS ccTLDs but did not involve a compromise of Google's systems." By controlling DNS records, the threat actor could request valid HTTPS certificates from Certificate Authorities by creating the TXT records that CAs require to verify domain ownership.

With modified authoritative DNS records in place, the attacker redirected .GH, .SL, and .AS domains to their own infrastructure while obtaining legitimate TLS certificates. This enabled them to impersonate legitimate organizations and deliver arbitrary content through the hijacked domains.

Google's Response and Protection Measures

Google immediately blocked the unauthorized certificates for its own properties using Chrome's CRLSets mechanism and coordinated with issuing authorities to revoke them. The company confirmed that its own infrastructure was not compromised and found no evidence of improper conduct by the issuing CAs.

After reviewing Certificate Transparency (CT) logs, Google identified additional certificates tied to the same attacks and blocked them in Chrome. The company explained: "Following our initial mitigation, Certificate Transparency (CT) log data revealed additional organizations, including several leading global brands and widely used online services, believed to have been impacted by the same attacks. To ensure users of those sites were kept safe as soon as possible, we proactively blocked these certificates in Chrome."

CRLSets functions as an emergency mechanism within Chrome that enables rapid blocking of revoked or untrusted HTTPS certificates. Chrome users require no action to gain protection from this incident.

Google cautioned that the scope of the attack may exceed what it has identified. The company stated: "Due to the complexity of DNS hijacks, we cannot guarantee that our analysis identified every affected domain, nor do Chrome interventions reliably protect non-Chrome users." CRLSets protections apply only to Chrome; users of other browsers may lack equivalent safeguards.

Recommendations for Organizations

  • Monitor Certificate Transparency logs across all domain holdings, including inactive or parked domains
  • Deploy restrictive Certification Authority Authorization (CAA) DNS records to restrict certificate issuance to authorized ACME accounts and validation methods

Google noted that CAA records cannot prevent certificate issuance during an active DNS hijack but do block additional certificates from being issued using cached domain validation once legitimate DNS control is regained.

Google did not disclose the identity of the attackers or the total number of fraudulent certificates issued in the incident.