Google reported that three country-code top-level domains, specifically .gh for Ghana, .sl for Sierra Leone, and .as for American Samoa, have been compromised. The company identified the attacks last week, noting that unauthorized parties gained access to third-party domain registry systems to alter authoritative DNS records.
By manipulating DNS settings, attackers successfully bypassed automated domain control validation processes used by certificate authorities. This allowed them to issue unauthorized HTTPS certificates, which were subsequently used to redirect web traffic and impersonate legitimate websites.
Google stated that all domains utilizing these specific suffixes are potentially at risk. The company clarified that there is no evidence of misconduct by the certificate authorities themselves. Chrome has responded by blocking affected certificates through its Certificate Revocation List sets, known as CRLSets.
To mitigate future risks, Google is collaborating with certificate issuers to revoke the compromised credentials. The company advises domain owners to monitor certificate logs continuously, including for parked and regional domains, and to implement restrictive Certificate Authority Authorization records to prevent further unauthorized issuance.
