Hackers obtain counterfeit TLS certificates for Google and other large services
ars ·
Hackers successfully obtained counterfeit TLS certificates for Google and other major services by compromising three country code top-level domains: .gh, .sl, and .as. By hijacking these registries, attackers modified DNS records to gain control over specific domains, allowing them to pass certificate authority validation tests. Google confirmed that Chrome has been updated to block all identified unauthorized certificates and coordinated with other browser providers to ensure similar protections. The company warned that this incident highlights the vulnerabilities in the current domain registration and certificate issuance processes. Although the immediate risk is mitigated through browser-side blocks, Google cautioned that undiscovered counterfeit certificates may still pose a threat. This event echoes the 2011 DigiNotar breach, where forged certificates were used to intercept traffic from hundreds of thousands of users. Domain owners are advised to monitor TLS transparency logs to detect any unauthorized certificate issuances for their sites.
ars