Attackers hijack top level domains to obtain unauthorized Google security certificates

Attackers compromised three country-code top-level domains and obtained unauthorized HTTPS certificates for several Google domains, according to The Hacker News, The Register, Gadget Review, news.lavx.hu, and CyberSecurityNews. Google said on October 6 that its own systems were not breached. However, any domain ending in .gh for Ghana, .sl for Sierra Leone, or .as for American Samoa was put at risk by the incident. [1][2][3][4][5]

The Hacker News reported that attackers obtained 12 unauthorized certificates for Google and YouTube domains after hijacking the .gh, .sl, and .as registries. A certificate authority acts as a trusted third party that stores, signs, and issues digital certificates to certify the ownership of a public key. With an unauthorized certificate, an attacker could pose as the genuine site over an encrypted connection and read private data sent to it. [1][7]

Google Domains operated as a domain name registrar and domain management service from 2014 until most of its assets were acquired by Squarespace on September 7, 2023. Following the breach, Google confirmed that its internal infrastructure remained secure, and Chrome acted to block the unauthorized certificates. [1][8]