Hijacked DNS earned certificates for Google domains

The padlock beside a web address means a certificate authority, a company your browser trusts, has checked that whoever asked for it controls that name. On 6 October, Google said attackers who altered DNS records under three country-code domains, Ghana's .gh, Sierra Leone's .sl and American Samoa's .as, obtained browser-trusted certificates for several Google domains and for other organisations' names (Google). Google says its own systems were not breached, and no public evidence shows the certificates were used against visitors.

The weak point sat above the websites, in DNS, the system that turns names into addresses. Picture each lookup as a chain of referrals. For a hypothetical acme.gh, the .gh zone holds a pointer naming the servers that answer for acme.gh, and those servers hand out the site's address. If someone changes that parent pointer, questions about acme.gh go to servers the attacker chooses (RFC 1034). Google has not said which records were altered, nor named the registry operators or accounts involved.

How a tampered address book can earn a padlock

Before issuing a certificate, an authority must check that the applicant controls the name. One common automated route runs through DNS itself. The authority hands over a fresh random code and checks that a matching record has appeared in that name's DNS (RFC 8555). Think of proving you live somewhere by receiving a letter sent there.

That is one way a DNS hijack could produce a certificate without anyone touching the real owner's servers. Other checks exist, including web-based challenges (Let's Encrypt), and Google has not said which one these attackers passed.

This is why Google believes the issuers did nothing wrong. Under industry rules, an issuer treats a successful check as evidence that the applicant controls the name (CA/Browser Forum). If the address book itself is giving misleading answers, an issuer following procedure to the letter can hand a valid certificate to the wrong party.

Two standard defences show why that address book is so sensitive. DNSSEC adds digital signatures to DNS answers, like a tamper-evident seal, so your device's lookup service can confirm an answer came through the expected chain of authority. The seal cannot reveal whether the domain owner wanted the change, so an edit published by a hijacked authority above the name would still check out.

CAA records let an owner list which certificate authorities may issue for its names. That list lives in the same DNS, though, so whoever controls the answers could in principle rewrite it (RFC 8659). Google has not said whether either safeguard was in place for the affected names.

Chrome pulls the certificates

Chrome blocked the certificates Google identified using CRLSets, a revocation list the browser pushes out to its users itself (Chromium). Google then searched Certificate Transparency, public logs where issued certificates are recorded, a bit like a land registry anyone can browse (Certificate Transparency). There it found more targets, which it describes as leading global brands without naming them.

Google says it contacted the owners it could reach, blocked their certificates in Chrome and worked with issuers to revoke them for other software. It warns that Chrome's measures do not reliably protect people using other browsers, and that it cannot guarantee it found every affected domain.

A certificate on its own sends nobody anywhere. To exploit one, an attacker would also have to steer people's connections to a server presenting it. Google reports no fake site, intercepted session or stolen credential, and Ars Technica's account largely retells Google's findings rather than confirming them independently (Ars Technica). No public evidence shows that the certificates were used against visitors.

What the incident does show is that a padlock is only as trustworthy as the DNS authority sitting above each name, small regional suffixes included. Google advises owners to monitor Certificate Transparency logs continuously across their whole portfolio, parked and regional domains included, because that is where a certificate they never requested would first become visible (Google).