Key points
- Cybercriminals seized control of DNS infrastructure for .gh, .sl, and .as domains.
- This allowed them to obtain unauthorized, valid HTTPS certificates for Google properties.
- Google blocked these certificates in Chrome but warns protection is not universal.
The short version
- Attackers hijacked the DNS systems behind three specific country-code top-level domains.
- They used this access to pass domain verification checks required for HTTPS certificates.
- The resulting certificates were valid and signed by trusted certificate authorities.
The details
According to research published by Malwarebytes Labs, cybercriminals compromised the infrastructure supporting the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) namespaces. These attackers used their control over the Domain Name System records to demonstrate apparent ownership of domains they did not legitimately control. By manipulating these DNS records, they successfully passed the verification checks required by certificate authorities to issue HTTPS certificates for Google domains and other organizations.
This activity did not involve a break in encryption protocols or a compromise of Google’s internal systems. Instead, it exploited the internet’s addressing infrastructure. The attackers redirected traffic to servers they controlled while presenting genuine, signed certificates. This combination allows them to create convincing impersonations of real services, as browsers see a valid secure connection to what appears to be the correct domain.
Google responded by blocking unauthorized certificates for its own properties within the Chrome browser. The company also worked with the issuing certificate authorities to revoke the compromised credentials. Later, Google extended these blocks to cover suspicious certificates for other organizations in Chrome. However, Google stated that these interventions do not guarantee complete protection, as they cannot identify every affected domain and do not reliably protect users of non-Chrome browsers.
The context
The Domain Name System directs internet traffic to the correct destination. Control over DNS records is often used to prove domain ownership when requesting an HTTPS certificate. A trusted certificate authority issues the certificate only after verifying that the applicant controls the relevant domain. By hijacking the DNS infrastructure, attackers can bypass this verification step.
This is an infrastructure-level problem that requires an infrastructure-level response. The risk extends beyond users in the specific countries represented by these domain endings, as these namespaces are not limited to sites serving those regions. The lasting fix depends on domain operators restoring control, preventing further unauthorized certificate issuance, and ensuring existing compromised certificates are revoked or blocked.
What to watch
Organizations should monitor for security notices if they use services with addresses ending in .gh, .sl, or .as. Users should remain cautious of unexpected requests, even if they appear to come from trusted services. Verifying requests through separate, trusted channels is essential, rather than using links provided in the suspicious communication. HTTPS alone is not an all-clear indicator if DNS hijacking has occurred.
Background: Encryption
Encryption is the process of converting plain text into ciphertext using an algorithm and a key. It prevents unauthorized access to data at rest and in transit. Without the correct decryption key, the information remains unintelligible, protecting privacy and integrity against interception or theft.
Read the full guide: What Is Encryption: Meaning, Definition, and How It Works
What to do and how to stay safe: Google
- Keep your browser and operating system updated to receive the latest security fixes and certificate blocklists.
- Do not bypass certificate or secure-connection warnings; stop loading the page if your browser reports a problem.
- Check for security notices from providers before logging in or sharing sensitive information with services using .gh, .sl, or .as domains.
- Verify unexpected requests through a separate, trusted channel rather than using contact details provided in the request itself.
Step-by-step guide: HTTPS Configuration Checklist for Secure Web Endpoints
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did attackers break into Google's servers?
No, according to Google, its systems were not compromised; the attackers manipulated DNS infrastructure to obtain fake certificates.
Are users of Firefox or Safari protected?
Google stated that Chrome interventions do not reliably protect non-Chrome users, leaving them potentially exposed to these hijacked domains.
Which country-code domains were compromised?
The compromised namespaces were .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa), as identified by Malwarebytes Labs.
