Google Confirms Hackers Stole Certs via .gh, .sl, .as Registries; Internal Systems Remain Secure

On October 6, Google disclosed that attackers had successfully compromised the registry operators for three country-code top-level domains (ccTLDs). The breach allowed threat actors to obtain unauthorized HTTPS certificates for various Google domains. The affected ccTLDs are .gh for Ghana, .sl for Sierra Leone, and .as for American Samoa. According to Google, the company’s own infrastructure and systems were not breached. However, the compromise of these third-party operators exposed any domain ending in those specific extensions to potential risk.

In plain English

HTTPS certificates act as digital IDs that prove a website is who it claims to be. They also encrypt the data shared between a user’s browser and the site. When an attacker obtains a fraudulent certificate for a legitimate domain, they can intercept encrypted traffic. This allows them to pose as the real site to users. In this case, attackers did not hack Google directly. Instead, they targeted the organizations responsible for managing the .gh, .sl, and .as domains. By compromising these registries, they were able to issue fake certificates that browsers might trust if they were associated with Google domains.

The background

The incident involved the manipulation of authoritative DNS records by the attackers, according to BleepingComputer. The threat actors breached the third-party operators managing the ccTLDs for Ghana, Sierra Leone, and American Samoa. Once inside these systems, they modified the necessary records to request and receive HTTPS certificates for Google properties. Infosecurity Magazine reported that the primary goal was obtaining these unauthorized certificates. The compromise highlights the risk inherent in the decentralized nature of the domain name system, where trust relies on the security of numerous independent registry operators.

What changes now

Google has stated that its own systems remain secure. The breach was contained to the external registry operators. However, the incident underscores the vulnerability of relying on third-party infrastructure for critical security functions like certificate issuance. Organizations using domains in these specific ccTLDs may need to review their security posture. The event serves as a reminder that a breach in one part of the internet’s foundational infrastructure can have ripple effects on major technology providers. Users and administrators should remain vigilant for signs of certificate manipulation, particularly for sites hosted on these affected domains.

What to do and how to stay safe: Google

• Monitor certificate transparency logs for unexpected or unauthorized certificate issuances for your organization’s domains.
• Verify that your web browsers and operating systems are updated to the latest versions to ensure they recognize current certificate revocation lists.
• Review DNS configurations for any domains you manage within affected ccTLDs to ensure no unauthorized changes have been made.
• Once the vendor provides an update, apply patches to any systems that may have been exposed to the fraudulent certificates.

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did hackers break into Google’s internal servers?

No, Google confirmed that its own systems were not breached; the attackers compromised external registry operators.

Which country-code top-level domains were affected by this attack?

The affected ccTLDs are .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa).

What did the attackers achieve with the compromised registries?

They obtained unauthorized HTTPS certificates for several Google domains and modified authoritative DNS records.