DNS hijacks enabled unauthorised certificates for Google

• Attackers compromised the .gh, .sl and .as domain namespaces and changed authoritative DNS records.
• They obtained unauthorised HTTPS certificates for several Google domains and domains belonging to other organisations.
• Google blocked certificates it identified in Chrome and worked with certificate authorities to revoke certificates for Google properties.
• Google has not named the other affected organisations or said whether the certificates were used to intercept users’ connections.

The attacks exploited control of three country-code namespaces: .gh for Ghana, .sl for Sierra Leone and .as for American Samoa. Google said the attackers changed authoritative DNS records and obtained certificates covering several Google domains and domains belonging to other organisations. The company said the incidents involved third-party namespaces, not a compromise of Google’s own systems.¹

A certificate is a digital credential that helps a browser check it is connecting to the site named in the address bar. To obtain one, an applicant must prove control of the domain. Ars Technica reported that control of the DNS records allowed the attackers to pass automated domain-control checks and secure the certificates.²

That creates the possibility of impersonating a website, but a certificate alone does not send a visitor to an attacker. The attacker would also need to get the visitor’s connection to the wrong server. Google and Ars Technica have not reported that the certificates were used to intercept real users’ traffic.

Google said it blocked certificates for Google properties in Chrome using CRLSets, Chrome’s system for quickly blocking certificates in emergencies. It also worked with the issuing certificate authorities to revoke those certificates, a measure intended to protect people using other clients.¹³

After its initial response, Google reviewed Certificate Transparency logs and found certificates it believed affected more organisations, including global brands and widely used online services. These public logs record certificates and can help reveal unexpected issuance. Google said it blocked the certificates it identified in Chrome and contacted affected organisations where possible, but did not name them.¹⁴

Google warned that its analysis might not have found every affected domain, and that Chrome’s intervention does not reliably protect people using other browsers. Its disclosure does not give the certificate count or validity periods, or establish whether certificates affecting other organisations were all revoked.¹²

Footnotes

1. Google Security Blog, “Chrome’s Response to Recent ccTLD Registry Hijacks” ↩ ↩² ↩³ ↩⁴

2. Ars Technica, “Hackers obtain counterfeit TLS certificates for Google and other large services” ↩ ↩²

3. The Chromium Projects, “CRLSets” ↩

4. Certificate Transparency, “How CT works” ↩