Attackers broke into the operators of the country-code domain registries for Ghana, Sierra Leone and American Samoa and used that access to obtain valid HTTPS certificates for several Google domains and sites belonging to other organizations, Google disclosed Wednesday, BleepingComputer reported. Google said its own systems were not compromised and that the rogue certificates have been revoked.

What Happened

The intrusions hit third-party operators that run the .gh, .sl and .as top-level domains, according to Help Net Security. With control of those registries, the attackers changed authoritative DNS records so that targeted domains pointed to infrastructure they controlled.

That DNS control was also enough to get certificates. Public certificate authorities typically confirm that an applicant controls a domain by asking it to publish a TXT record with a specific value. Because the attackers could write any DNS record they wanted for the affected domains, they could pass those checks and receive certificates that browsers would trust.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

Google said it had no reason to believe the certificate authorities that issued the certificates acted improperly, and it did not name them. It worked with the authorities to revoke the certificates and pushed them into CRLSets, Chrome's emergency mechanism for blocking certificates. Searching Certificate Transparency logs, the public records of issued certificates, turned up more affected domains, including what Google described as several leading global brands and widely used online services. It did not identify those organizations.

The Register reported that Google learned of the attacks last week. Google has not said who was behind them, how the registry operators were breached, when the activity began or how many certificates were issued.

Why It Matters

A trusted certificate combined with control of a domain's DNS lets an attacker stand up a convincing copy of a site with no browser warning, which can be used to intercept logins and traffic or to deliver malware. The attack did not require breaking into Google or into any certificate authority. It exploited the fact that domain validation trusts whoever controls DNS, and that a registry sits above every domain registered under it.

Google's own protections have limits. The CRLSets block works only in Chrome, and Google cautioned that its analysis may not have found every affected domain and that its browser interventions do not reliably protect people using other browsers. It said browser-side blocking should not be the only line of defense.

Advice for Domain Owners

Google is urging organizations to watch Certificate Transparency logs for all of their domains, including inactive ones, so that unexpected certificates are spotted quickly. It also recommends publishing restrictive Certification Authority Authorization records, which tell certificate authorities which issuers and validation methods are allowed for a domain.

BleepingComputer noted that CAA records cannot stop issuance while an attacker is actively hijacking DNS, since the attacker can rewrite them too. They can, however, prevent new certificates from being issued later on the strength of cached domain validation once the legitimate owner regains control.

What to Watch

For the longer term, Google said it will push through its root program for shorter certificate validity periods and less reuse of earlier domain validation, according to Help Net Security. Further revocations are possible as more Certificate Transparency records are examined. Statements from the registry operators for Ghana, Sierra Leone and American Samoa, or from the brands Google left unnamed, would be the first indication of how long the attackers had access and whether the certificates were used against anyone.