Google Confirms Impact from ccTLD Hijacks Targeting .gh, .sl, and .as Domains
Google disclosed that several of its domains were compromised in a recent series of hijacks affecting third-party country-code top-level domains (ccTLDs). The incident occurred last week and specifically targeted the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) domain extensions, putting all websites using these suffixes at risk of DNS-based attacks.
According to Google, attackers successfully modified authoritative DNS records during the hijacking events, which allowed them to obtain unauthorized HTTPS certificates for multiple Google-owned domains as well as domains belonging to other organizations worldwide.
“During these hijacks, attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains, as well as domains belonging to other organizations,” the company stated in its advisory.
Certificate Authorities Not at Fault, Says Google
Google emphasized that the Certification Authorities (CAs) responsible for issuing the fraudulent certificates should not be held accountable for the breach. The company explained that the nature of the attack — involving DNS manipulation rather than CA system failures — meant the CAs followed standard procedures based on compromised validation data.
This distinction is critical because it shifts focus to the underlying DNS infrastructure as the point of failure, not the certificate issuance process itself.
Immediate Response: Certificate Blocking and Revocation Efforts
Upon discovering the incident, Google took swift action to protect users. The company immediately blocked the unauthorized certificates for its domains within the Chrome browser to prevent potential man-in-the-middle attacks.
In parallel, Google collaborated with the involved Certificate Authorities to revoke the illicit certificates, leveraging standard revocation mechanisms to limit their validity and misuse.
Wider Impact Revealed Through Certificate Transparency Logs
An analysis of Certificate Transparency (CT) log data showed that the impact extended beyond Google. Multiple other organizations, including global brands and widely used online services, were also affected by the same hijacking campaign.
This broader exposure underscores the systemic risk posed by ccTLD vulnerabilities when exploited at scale.
“To ensure users of those sites were kept safe as soon as possible, we proactively blocked these certificates in Chrome. Where possible, we reached out to impacted organizations to alert them to our findings and actions,” Google said.
Ongoing Risks and Recommendations for Domain Owners
Despite Google’s mitigation efforts, the company cautioned that some domains might still be vulnerable or showing residual effects from the hijacks. It urged all domain owners — particularly those with assets in .gh, .sl, or .as zones — to remain vigilant.
Google specifically recommended two proactive defenses:
- Regularly monitor Certificate Transparency (CT) logs for all domains to detect unauthorized certificate issuance early.
- Implement restrictive Certification Authority Authorization (CAA) DNS records to limit which CAs can issue certificates for a domain.
“Because CAs are permitted to cache and reuse completed domain control validation (DCV) checks for subsequent issuance, restoring a restrictive CAA policy, especially one that restricts issuance to specific authorized accounts and validation methods, prevents an attacker from using cached validation state to mint new certificates after a hijack ends,” Google noted.
This guidance highlights a key security gap: even after DNS control is restored, attackers may exploit cached validation states to issue fraudulent certificates unless CAA policies are tightened.
Broader Implications for Internet Security
The incident serves as a reminder of the interconnected risks in the global DNS and PKI ecosystem. While Google’s rapid response helped protect Chrome users, the event reveals how compromises in smaller or less-monitored ccTLDs can have cascading effects on major international brands and services.
As of the disclosure, Google did not attribute the hijacks to any specific threat actor or geopolitical source, focusing instead on technical mitigation and user protection.
Source: SecurityWeek