Hackers Hijack Three ccTLD Registries to Issue Unauthorized HTTPS Certificates for Google Domains
What Happened – Attackers seized control of the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) country‑code top‑level domain (ccTLD) registries. Using that foothold they altered DNS records and obtained fraudulent HTTPS certificates for several Google‑owned domains as well as other high‑profile brands. Google detected the abuse, revoked the certificates and blocked them in Chrome via CRLSets.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient oversight of third‑party infrastructure that can be leveraged to undermine the TLS trust chain.
- Highlights the need for continuous monitoring and evidence collection on vendor security posture to satisfy audit‑ready control‑assurance programs.
- Shows that relying solely on browser‑side mitigations is inadequate; organizations must maintain independent certificate‑validation processes.
Who Is Affected – Global internet‑facing organizations across all sectors that rely on DNS registries and public‑key infrastructure, including large technology firms, e‑commerce platforms, and any entity using the compromised ccTLDs.
Recommended Actions
- Map this incident to your third‑party risk management controls and verify that registrars are subject to continuous security monitoring.
- Incorporate certificate‑transparency log monitoring into your TLS validation workflow to detect unauthorized issuance promptly.
- Review and harden DNSSEC and domain‑validation (DV) procedures with your registrar contracts, demanding evidence of regular security audits.
Source: Help Net Security
Technical Notes – The attackers compromised the registries through an undisclosed method (likely credential theft or supply‑chain intrusion) and then performed DNS record changes to pass domain‑validation checks. No Google systems were breached; the issuing Certificate Authorities were not found at fault. Google leveraged Certificate Transparency logs and Chrome’s CRLSet to revoke the fraudulent certificates. Source: same as above