Hackers forge TLS certificates for Google via ccTLD hijack

Attackers have obtained counterfeit TLS certificates for Google and other prominent online services by hijacking three country-code top-level domains (ccTLDs). The breach allowed the issuance of fraudulent credentials that could be used to impersonate legitimate infrastructure cryptographically, posing significant security risks for users and organisations relying on encrypted connections.

What happened

The attackers targeted the registries for .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa), gaining control over DNS records for domains under these TLDs. With this access, they were able to generate unauthorised TLS certificates for several Google domains, as well as other widely used services and global brands. Google confirmed the incident and stated that it had taken steps to mitigate the impact, including updating Chrome to block the identified counterfeit certificates. The company also collaborated with other certificate authorities to ensure broader browser protection.

TLS certificates serve as the foundation for authentication and encryption on the internet, verifying the identity of websites and securing data in transit. When attackers obtain fraudulent certificates, they can intercept or manipulate traffic, making it appear as though users are connecting to legitimate services while actually communicating with malicious infrastructure. The incident highlights vulnerabilities in the certificate issuance process, particularly when attackers exploit weaknesses in domain registry controls.

Why it matters

The ability to forge TLS certificates undermines the trust model that underpins secure internet communications. If attackers can impersonate trusted services, users may unknowingly expose sensitive data, such as login credentials or financial information, to malicious actors. The incident also raises concerns about the security practices of ccTLD registries, which may not always have the same level of oversight or resources as larger, more established registries.

For organisations, the breach underscores the importance of monitoring certificate transparency logs and implementing additional security measures, such as certificate pinning or DNSSEC, to detect and prevent unauthorised certificate usage. The rapid response from Google and other browser vendors helped contain the immediate threat, but the incident serves as a reminder of the ongoing risks associated with certificate-based authentication.

What to watch

The long-term impact of this breach will depend on how registries and certificate authorities address the underlying vulnerabilities. Registries for ccTLDs may face increased scrutiny over their security practices, particularly in regions with limited resources for cybersecurity. Meanwhile, organisations should review their reliance on TLS certificates and consider adopting supplementary security protocols to mitigate the risk of impersonation attacks.

Google’s actions to block the counterfeit certificates demonstrate the role that browser vendors play in maintaining internet security. However, the incident also highlights the need for a more robust and resilient certificate infrastructure, potentially involving decentralised or blockchain-based solutions that reduce reliance on centralised authorities.