🔍 ccTLD hijacks enabled counterfeit certs for Google domains

Google says attackers hijacked the .gh, .sl, and .as registries, altered authoritative DNS records, and obtained unauthorized HTTPS certificates for several Google domains and other organizations. Chrome has already blocked suspected rogue certs across the affected namespaces, but Google says its own systems were not breached. The company advises monitoring Certificate Transparency logs and reviewing recent issuance in those ccTLDs.

This is a registry-level trust failure: control of DNS plus valid-looking certificates can remove normal browser warning signals and support convincing impersonation, interception, phishing, or malware delivery. Chrome-side blocking reduces exposure for some users, but Google notes it may not identify every affected domain and does not reliably protect non-Chrome traffic.

🛰️ Open sources - closed narratives
@sitreports