Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains

Summary: Attackers compromised the .gh, .sl and .as country-code top-level domains and obtained unauthorized HTTPS certificates for Google and YouTube domains, Google disclosed on October 6; Google's own systems were not breached. Certificate Transparency logs showed at least 12 domain-validated certificates issued between September 22 and 27 for seven domains, including google.com.gh, google.sl and google.as, with Let's Encrypt issuing 11 and ZeroSSL one, and all were revoked by October 7.
What you should know: The attackers changed authoritative DNS records during the hijacks, and Google says CT data points to other well-known global brands and widely used online services hit by the same attacks, which it did not name. Google also warns that Chrome's blocks do not reliably protect people using other browsers, and that a completed domain check can be reused for up to 200 days under the Baseline Requirements.

Read the original at The Hacker News ↗