Country-code TLD hijacks reportedly yielded unauthorized HTTPS certificates for Google domains

Authoritative DNS altered for three country-code domains

According to the report, Google became aware of attacks involving the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) country-code top-level namespaces. Google said attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains and domains belonging to other organizations. Google said its own systems were not compromised and that Chrome blocked suspected unauthorized certificates across the affected namespaces, while warning that browser-side measures may not identify every affected domain or reliably protect non-Chrome users.

The available report does not establish a comparable prior condition or quantify how many domains or organizations were affected.

The reported change is that control of authoritative DNS records in the affected country-code namespaces was allegedly used to obtain unauthorized HTTPS certificates for Google domains and domains of other organizations.

DNS control and HTTPS certificates are key parts of how browsers route users to and authenticate websites. Google warned that this combination can enable impersonation of legitimate sites without the usual browser certificate warnings.