Attackers compromised the .gh, .sl, and .as country code top-level domains to modify DNS records. By redirecting traffic, they successfully obtained unauthorized TLS certificates for several Google domains and various global online services.
Google updated the Chrome browser to block the identified counterfeit certificates and coordinated with other certificate authorities to implement similar protections. The company confirmed that the incident did not involve a direct compromise of the infrastructure of the affected domain owners or DNS operators.
Despite the mitigation efforts, Google stated it cannot guarantee that all unauthorized certificates have been identified. The company advises domain owners to monitor TLS transparency logs for any suspicious issuance of certificates associated with their addresses.
The process of revoking certificates remains complex, leading stakeholders to rely on browser-level blocking as a faster alternative. Google emphasized that browser-side interventions are not a complete solution and do not protect users of non-Chrome browsers.
