Domains Hijacked for Fake Google Certificates

Attackers have successfully hijacked three country code top-level domains (ccTLDs) – .gh, .sl, and .as – to mint counterfeit TLS certificates. These certificates were created for several Google domains and other leading global brands, enabling attackers to impersonate legitimate online services. Google has since updated Chrome to block all identified counterfeit certificates and is working with other certificate authorities to ensure broader browser protection.

The exploitation of these ccTLDs allowed attackers to modify DNS records and intercept traffic, passing certificate authority tests by proving control over the affected domains. This incident underscores a critical weakness in the certificate issuance chain, as it did not involve a compromise of the domain owners' or DNS operators' infrastructure.

This is not the first instance of such an attack. A similar incident in 2011 involved the compromise of Dutch certificate authority DigiNotar, leading to the issuance of forged certificates used in attacks against thousands of users. While Google has taken steps to mitigate the current threat by blocking known counterfeit certificates, it cautions that undiscovered certificates may still pose a risk.