Attackers Hijack .gh, .sl, and .as Registries to Obtain Fraudulent Certificates for Google Domains
What Happened — Attackers compromised the country‑code top‑level domain (ccTLD) registries for Ghana (.gh), Sierra Leone (.sl) and American Samoa (.as). Using the hijacked registries they issued unauthorized HTTPS certificates for several Google‑owned domains. Google’s internal systems were not breached, but any site ending in those TLDs could be impersonated with a valid TLS certificate.
Why It Matters for Trust & Control Assurance
- This is a classic supply‑chain risk scenario: a third‑party infrastructure provider (the registry) was subverted, creating a window for credential‑level abuse of TLS trust.
- Continuous third‑party risk monitoring and evidence collection are essential to detect registry anomalies before malicious certificates are issued.
- Demonstrable oversight of PKI issuance processes satisfies a control objective that maps across multiple frameworks (e.g., NIST CSF 2.0 “Supply Chain Risk Management”).
Who Is Affected – Internet service providers, SaaS platforms, enterprises that rely on DNS and TLS for brand protection, especially those with assets in the affected ccTLDs.
Recommended Actions
- Verify all TLS certificates for your domains that use .gh, .sl, or .as TLDs; revoke any that were not issued by your authorized CA.
- Strengthen third‑party oversight: require registrars to provide real‑time certificate issuance logs and integrate those logs into your continuous control‑assurance platform.
- Update incident‑response playbooks to include registry compromise detection and rapid certificate revocation.
Technical Notes – The attackers leveraged privileged access to the registry’s certificate‑authority interfaces, likely via compromised registrar credentials. No CVE is associated; the vector is a supply‑chain breach of the registry’s operational controls. Source: The Hacker News