Google has announced that several of its domains were recently affected by a hijacking of third-party country-code top-level domains (ccTLDs).
The incident occurred last week and affected the ccTLDs .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa), putting all domains with these suffixes at risk.
“During these hijackings, attackers changed key DNS records and obtained unauthorized HTTPS certificates covering multiple Google domains as well as domains of other organizations,” the internet giant said says.
According to Google, the certification authorities (CAs) that issued the certificates should not be blamed given the nature of the attacks.
Immediately after learning of the incident, Google blocked the unauthorized certificates for its domains in Chrome and worked with the issuing certificate authorities to revoke them.
Analysis of Certificate Transparency (CT) log data revealed that several other organizations, including global brands and popular online services, were affected.
“To ensure that users of these websites are protected as quickly as possible, we have proactively blocked these certificates in Chrome. Where possible, we have reached out to affected organizations to inform them of our findings and actions,” Google says.
The internet giant notes that while it has taken measures to identify and block the unauthorized certificates, certain domains may still be affected.
Google recommends domain owners monitor CT logs for all their domains, especially those in .gh, .sl, or .as, and publish restrictive CAA DNS records to ensure protections after DNS control is reestablished.
“Because CAs are permitted to cache completed Domain Control Validation (DCV) checks and reuse them for later issuance, restoring a restrictive CAA policy, particularly one that limits issuance to specific authorized accounts and validation methods, prevents an attacker from using the cached validation state to create new certificates after a hijack ends,” Google notes.
Related: Chrome 155 Update fixes 247 security vulnerabilities
Related: Zero Trust Creator says the model is resilient to AI-powered attacks
Related: Anthropic quickly routes AI error messages to OSS maintainers and engages 11 companies with OT security
Related: Long-running NPM malware campaign records 40,000 downloads
