The browser can show a secure HTTPS connection even with an attacker server. Hackers have seized the management of three national domain zones and received valid certificates for Google addresses and other services. Google reported that the attacks affected .gh, .sl and .as, and the company's own systems were not hacked.
The registers of the domain zones of Ghana, Sierra Leone and American Samoa were hit. The attackers changed the authoritative DNS records and the delegation of name servers for the selected domains, redirecting the verification traffic to their infrastructure. Such control allowed to pass the standard check of the domain ownership and to request a certificate from the trusted certification center.
The certification authorities themselves did not violate the rules: their verification showed that the applicant did control the address. A valid TLS certificate confirms the domain in front of the browser and allows you to establish an encrypted connection. Certificate Transparency magazines later helped discover certificates that the real owners did not request.
Verification of open magazines found at least 12 certificates for seven Google and YouTube addresses released from 22 to 27 September. Eleven documents were issued by Let’s Encrypt, another ZeroSSL. Addresses included google.com.gh, google.sl, google.com.sl, google.as and YouTube domains in the same national zones. By 7 October, all 12 were withdrawn.
Chrome blocked Google's identified certificates through the CRLSets, and certifying centers withdrew them to protect users of other customers. The CT data then pointed to the certificates of several major brands and popular online services, and Chrome added known samples to the lock. Google did not name other organizations and did not say whether the certificates were used in real attacks.
The danger of such certificates is that the browser can accept an attacker's server for the present and install an encrypted connection with it without the usual warning. Control over DNS together with the correct certificate creates conditions for convincing site swap and traffic interception. Google does not guarantee that every affected domain has been found.
Google domain owners are advised to constantly check CT logs and publish strict CAA records that limit the range of centers that are allowed to issue certificates. The CAA will not stop the release during the active DNS capture, but after the recovery of control prevents you from reusing the saved domain verification results. Chrome users do not need additional actions.
The registers of the domain zones of Ghana, Sierra Leone and American Samoa were hit. The attackers changed the authoritative DNS records and the delegation of name servers for the selected domains, redirecting the verification traffic to their infrastructure. Such control allowed to pass the standard check of the domain ownership and to request a certificate from the trusted certification center.
The certification authorities themselves did not violate the rules: their verification showed that the applicant did control the address. A valid TLS certificate confirms the domain in front of the browser and allows you to establish an encrypted connection. Certificate Transparency magazines later helped discover certificates that the real owners did not request.
Verification of open magazines found at least 12 certificates for seven Google and YouTube addresses released from 22 to 27 September. Eleven documents were issued by Let’s Encrypt, another ZeroSSL. Addresses included google.com.gh, google.sl, google.com.sl, google.as and YouTube domains in the same national zones. By 7 October, all 12 were withdrawn.
Chrome blocked Google's identified certificates through the CRLSets, and certifying centers withdrew them to protect users of other customers. The CT data then pointed to the certificates of several major brands and popular online services, and Chrome added known samples to the lock. Google did not name other organizations and did not say whether the certificates were used in real attacks.
The danger of such certificates is that the browser can accept an attacker's server for the present and install an encrypted connection with it without the usual warning. Control over DNS together with the correct certificate creates conditions for convincing site swap and traffic interception. Google does not guarantee that every affected domain has been found.
Google domain owners are advised to constantly check CT logs and publish strict CAA records that limit the range of centers that are allowed to issue certificates. The CAA will not stop the release during the active DNS capture, but after the recovery of control prevents you from reusing the saved domain verification results. Chrome users do not need additional actions.
