Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
-
Attackers compromised the registries responsible for three country-code top-level domains (ccTLDs) and used that access to obtain unauthorized HTTPS certificates for several Google domains, according to a disclosure from Google on October 6.
Google confirmed that its own systems were not breached, but warned that any domain ending in .gh (Ghana), .sl (Sierra Leone), or .as (American Samoa) was put at risk by the incident. Because the certificates were issued through the hijacked registries, an attacker holding one could impersonate the legitimate site over an encrypted connection, undermining the trust users place in HTTPS.
Key points:
- Three ccTLD registries were hijacked: .gh, .sl, and .as
- Unauthorized HTTPS certificates were issued for multiple Google domains
- Google's internal systems were not compromised
- Any domain under the affected TLDs should be treated as potentially exposed
For defenders and domain owners, this serves as a reminder that certificate issuance depends on the integrity of the registry chain, and that compromise at the registry level can have downstream effects well beyond a single organization.
Source: [email protected] (The Hacker News)
If your organization owns domains under .gh, .sl, or .as, have you reviewed your certificate logs or reached out to your registrar yet?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login