Several high-level domains, including those belonging to Google, were recently compromised through DNS record manipulation. Attackers gained control over domain settings to request unauthorized TLS certificates. By successfully obtaining these certificates, hackers could redirect traffic to their own servers, enabling interception and decryption of data.
Google confirmed that its internal systems remain secure and that certificate authorities followed standard protocols, as the unauthorized requests appeared legitimate based on valid DNS records. To mitigate the threat, Google utilized the Chrome CRLSet mechanism to block identified fraudulent certificates and coordinated with certificate authorities to revoke them.
The company analyzed certificate transparency logs and identified that multiple global brands and online services may be affected. While Google has not released a specific list of impacted entities or the total number of certificates involved, it warned that DNS hijacking remains a complex issue that cannot be fully resolved solely through browser-side blocking.
Google advises domain owners, particularly those using GH, SL, and AS extensions, to monitor their certificate transparency logs via the crt.sh platform. If unauthorized certificates are detected, administrators should immediately contact the issuing authority to revoke them and audit their DNS security settings to remove any malicious records.
