Google says attackers hijacked domain records to obtain unauthorized TLS certificates

Attackers hijacked three country code top-level domains and obtained unauthorized TLS certificates for Google and other large organizations, Google said Tuesday. They modified authoritative DNS records within .gh, .sl and .as to pass automated checks that validate control of a domain. The certificates allow attackers to cryptographically impersonate affected Internet infrastructure. Google updated Chrome to block the unauthorized certificates it identified and worked with issuing authorities to revoke those for Google properties. It advised domain owners to monitor certificate transparency logs and restrict which authorities can issue certificates through DNS records. Google cautioned that domain owners should not rely solely on browser interventions to protect users.