Attackers took over three country-code top-level domains and used that control to mint counterfeit TLS certificates for Google and other big names, Google said on a Tuesday in early October. The domains were .gh, .sl and .as.
Here’s how it worked, in plain terms. The attackers first broke into the three namespaces. They then altered the authoritative DNS records for selected domains inside them. Certificate authorities check that an applicant controls a domain by looking at its DNS, and those automated checks cannot tell a rightful owner from someone holding the records. The attackers passed them and walked away with unauthorized certificates for “several Google domains” and “several leading global brands and widely used online services.”
Why a certificate matters
Think of a TLS certificate like a passport for a website. It binds a domain name such as google.com to a public key, and only the site operator holds the matching private key. When the keys match, your browser knows it has reached the real site and not an impostor. Certificates secure websites, mail servers and other internet infrastructure. Someone holding a bogus one can cryptographically impersonate the affected service, which is why issuance is the weak link in the chain.
What Google did
Google updated Chrome to block every certificate it identified as unauthorized. It also worked with the issuing certification authorities to get the certificates for Google properties revoked. The practical upshot for ordinary Chrome users is that nothing needs doing; Google said they are protected.
Google did not say which of its domains were affected, and it did not name the other organizations caught up in the attack. It did warn domain owners against leaning only on browser-side fixes. Its advice is to watch certificate transparency logs for unexpected issuance across their domains. It also recommends publishing restrictive Certification Authority Authorization DNS records, so attackers cannot reuse cached validation data once control of the DNS is restored.
