Something’s off.A report says attackers compromised third-party operators for the .GH, .SL, and .AS country-code domains, then altered authoritative DNS records. That reportedly let them add the TXT records used in certificate checks, obtain valid HTTPS certificates for domains they did not own, and direct affected domains to infrastructure they controlled.
The odd part is that DNS-based certificate validation is meant to demonstrate control of a domain. According to the report, control of the registry-level DNS records could instead make that check produce certificates for an attacker. Google said its own systems were not compromised, but said it could not guarantee that every affected domain had been identified. It also warned that Chrome’s certificate blocking does not reliably protect people using other browsers.
UNVERIFIED
Feed metadata identifies a report, not independently verified underlying facts.
This report has not been independently verified.
