Google HTTPS: DNS Hijacking via Compromised ccTLD Operators Yields Fraudulent Certificates

Google disclosed on October 6 that threat actors had compromised three country-code top-level domains to obtain unauthorized HTTPS certificates for various Google properties. The incident involved the hijacking of domains in the .gh, .sl, and .as namespaces, posing a risk to users relying on encryption for these specific extensions.

What happened

According to reports from The Hacker News and BleepingComputer, attackers targeted the registries responsible for Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as). The group did not breach Google’s own systems; instead, they compromised the third-party operators managing these specific ccTLDs. By gaining access to these registries, the attackers were able to modify authoritative DNS records.

This access allowed them to request and receive unauthorized HTTPS certificates for domains under Google’s control. Infosecurity Magazine noted that the core objective was obtaining these fraudulent certificates, which would enable an attacker to impersonate legitimate Google sites over encrypted connections.

Why it matters

This incident highlights the fragility of the public key infrastructure supply chain. While Google’s backend systems were not breached, the validation process for domain ownership was circumvented at the registry level. For software developers, this underscores that certificate validity depends not just on cryptographic strength, but on the security of the registrars and registries issuing them.

The compromise of .gh, .sl, and .as demonstrates that attackers are willing to target less prominent or resource-constrained ccTLD operators to gain high-value credentials. Users visiting sites with these extensions faced potential man-in-the-middle attacks, as the unauthorized certificates could not be distinguished from valid ones without additional verification steps.

What to watch

• Monitor certificate transparency logs for unusual issuance patterns in affected ccTLDs.
• Review DNS configuration security for any domains hosted in compromised registries.
• Watch for advisory updates from registry operators regarding access controls.
• Verify certificate chain integrity for services relying on these specific TLDs.

Background: Man-in-the-middle attacks

An attacker positions themselves between two communicating parties, often by compromising a local network or using DNS spoofing. They decrypt traffic, read or alter the data, and re-encrypt it before forwarding it. The attack succeeds when you cannot verify the identity of the endpoint you believe you are contacting.

Read the full guide: How Man-in-the-Middle Attacks Intercept Your Data Step by Step

What to do and how to stay safe: Google

• Audit your organization’s reliance on services or partners using .gh, .sl, or .as domains.
• Implement certificate pinning for critical internal services to prevent acceptance of rogue certificates.
• Enable monitoring for unexpected changes in authoritative DNS records for your assets.
• Review third-party vendor security assessments, particularly for those managing domain registration.

Step-by-step guide: Social Engineering: How Manipulation Bypasses Technical Defenses

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did attackers breach Google’s internal servers?

No, Google confirmed that its own systems were not breached; the compromise was limited to third-party ccTLD registry operators.

Which country-code top-level domains were compromised?

The registries for Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as) were compromised.

How did the attackers obtain the certificates?

Attackers modified authoritative DNS records after breaching the third-party operators managing these registries.