Registry breaches let attackers hijack domains and obtain HTTPS certificates

Attackers compromised third-party operators for Ghana's .GH, Sierra Leone's .SL and American Samoa's .AS domains, changed authoritative DNS records and obtained unauthorized HTTPS certificates, BleepingComputer reported. Google domains and other organizations were affected. Control of those records let attackers redirect visitors to their own infrastructure and impersonate legitimate brands. Google blocked unauthorized certificates in Chrome and worked with certificate authorities to revoke them. It also identified and blocked additional certificates through public Certificate Transparency logs. Google says its own systems were not compromised and it has no reason to believe certificate authorities acted improperly. Its analysis may have missed affected domains, and Chrome's blocking mechanism does not reliably protect users of other browsers.