In a recent security breach, hackers have exploited the domain registries of Ghana, Sierra Leone, and American Samoa, issuing unauthorized HTTPS certificates for major organizations including Google. Google’s proactive response involved Chrome automatically blocking these certificates, while Google collaborated with certification authorities to revoke them.
Details of the Breach
On October 6, Google disclosed that it had discovered the breach in the previous week. The compromised domains—.gh, .sl, and .as—put numerous websites at risk, although Google clarified that not all domains were affected. Significantly, Google’s internal systems remained secure throughout the incident, and the certificate authorities involved were not at fault. The hackers targeted the third-party domain infrastructure, which is critical for certificate validation processes.
Mechanics of DNS Hijacking
The attackers manipulated authoritative DNS records, which are essential for domain lookups. By controlling these records, attackers can falsify domain control validation, misleading certificate authorities into issuing certificates. This process typically checks whether the requester can publish a specific DNS record, a step that can be bypassed if an attacker controls the DNS infrastructure.
Although possessing an unauthorized certificate could allow attackers to mimic trusted websites, this requires redirecting users to their servers. Google’s report did not confirm whether the certificates were used in active traffic interception.
Chrome’s Protective Measures
Google promptly used CRLSets, Chrome’s emergency certificate blocking system, to invalidate the compromised certificates for its domains. Additionally, Google engaged with issuing authorities to ensure these certificates were revoked across all platforms, not just Chrome.
Further analysis of Certificate Transparency logs revealed certificates linked to other major organizations. Google continues to block these certificates in Chrome and alerts affected parties. However, Google cautions that some domains may still be undetected, emphasizing the importance of domain owners conducting their own checks.
To enhance security, organizations are advised to monitor Certificate Transparency logs vigilantly and explore tools for detecting unauthorized certificate issuance. Google also suggests implementing restrictive Certification Authority Authorization records and considering shorter certificate lifetimes and reduced validation reuse to bolster security practices.
In conclusion, while the breach underscores vulnerabilities in domain and certificate management, Google’s swift actions and recommendations aim to mitigate risks and enhance future security protocols.
