Hackers hijack Google domains after breaching ccTLD registries
-
Attackers compromised third-party operators of country-code top-level domain (ccTLD) registries and modified authoritative DNS records, allowing them to hijack domains belonging to Google and obtain unauthorized HTTPS certificates for those domains.
The impacted ccTLDs are:
- Ghana
- American Samoa
- Sierra Leone
According to the reporting, the intruders gained access by breaching third-party operators rather than the registries themselves, then altered authoritative DNS records to redirect or take control of the affected domains. The unauthorized certificate issuance for Google domains is a notable escalation, since valid HTTPS certificates can make hijacked domains appear legitimate to visitors and can undermine trust assumptions built into web traffic.
Details on the exact domains affected, the timeline of the compromise, and any remediation guidance have not been fully outlined in the available reporting.
Source: BleepingComputer
If your organization depends on domains under these ccTLDs, have you reviewed your DNS records and certificate logs for signs of tampering?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login