Google disclosed on Tuesday that attackers compromised the registry systems of three country-code top-level domains, altered authoritative DNS records for selected domains, and used that control to pass automated domain validation checks — walking away with unauthorized TLS certificates for "several Google domains" and "several leading global brands and widely used online services." Google has updated Chrome to block every unauthorized certificate it identified and is working with the issuing certificate authorities to revoke the fraudulent ones.
The attackers targeted the registries behind .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). Once inside, they modified the authoritative DNS records and nameserver delegations for chosen domains within those namespaces. Google stressed that the incident "didn't involve the compromise of the infrastructure of any of the affected domain owners and that certificate authorities followed all requirements" — once a registry falls, domain-control validation is effectively defeated.
Before issuing a TLS certificate, authorities verify that the applicant controls the domain, usually by placing a token in DNS records or answering an HTTP challenge. With the authoritative DNS records under their control, the attackers sailed through. In Google's words, they were able to "pass automated domain control validation checks" by controlling those records. Because the certificates were issued by legitimate authorities, browsers raised no warnings — opening the door to man-in-the-middle attacks, phishing, and traffic interception that users could not detect.
Google said the fraudulent certificates covered "several Google domains" plus those of "several leading global brands and widely used online services," but it did not name the domains or the other organizations. Google acknowledged it is "not immediately clear what the other affected organizations are, how many unauthorized certificates were issued, or if all of them, except for those for Google domains, have been blocked."
Google said it updated Chrome to block all certificates it identified as unauthorized and worked with the issuing authorities to ensure the fraudulent certificates for Google properties were revoked. Chrome users "do not need to take any action to be protected." But Google also warned: "While Chrome took steps during these incidents to identify and block suspected unauthorized certificates across the affected ccTLDs, browser-side intervention should not be relied on to protect your users." It added: "Due to the complexity of DNS hijacks, we cannot guarantee that our analysis identified every affected domain, nor do Chrome interventions reliably protect non-Chrome users."
For domain owners, Google issued two concrete recommendations: continuously monitor Certificate Transparency logs for unexpected certificate issuance against your domains, and "publish restrictive Certification Authority Authorization DNS records to prevent attackers from reusing cached validation data after DNS control is restored." Google noted that the official revocation process is slow and cumbersome — which is why browser vendors built faster browser-level blocking. All known unauthorized certificates are now blocked, so the immediate risk is mitigated, but any undiscovered certificates remain a threat.
The internet has been here before. In 2011, Dutch certificate authority DigiNotar was hacked, and attackers minted counterfeit certificates for Google.com and more than 200 other high-traffic domains — some used in surveillance against at least 300,000 people with ties to Iran. DigiNotar went bankrupt in the aftermath. Fifteen years later, the attack has moved from breaching certificate authorities to breaching domain registries — the weakest link in the chain of trust is always where attackers strike.