Attackers compromised the domain registries of Ghana (.GH), American Samoa (.AS), and Sierra Leone (.SL). By modifying authoritative DNS records, the hackers redirected traffic from several domains, including those owned by Google, to infrastructure under their control.
The attackers used their DNS access to generate valid HTTPS certificates. By creating required TXT records, they bypassed certificate authority validation, allowing them to present fraudulent websites as legitimate and secure to web browsers.
Google responded by using its CRLSets mechanism to block the compromised certificates within the Chrome browser. After reviewing Certificate Transparency logs, the company identified that other major global brands and online services were also affected and added their certificates to a blacklist.
Google noted that its internal systems remained secure throughout the incident. However, the company warned that because CRLSets is specific to Chrome, users of other browsers may still face risks when visiting spoofed websites.
To mitigate future risks, Google recommends that domain owners configure Certification Authority Authorization (CAA) records. While this does not prevent DNS hijacking, it helps block the issuance of unauthorized certificates after control over a domain is restored.
