HN

Need help?
<- Back
Hackers obtain counterfeit TLS certificates for Google and other large services

Hackers obtain counterfeit TLS certificates for Google and other large services

colinprince

Comments (35)

  • Borealid
    This sounds like something that HPKP ( https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning ) could have prevented and CAA records ( https://letsencrypt.org/docs/caa/ ) could not. But HPKP is deprecated.
  • iso1631
    So looks like1) Top level CC DNS entries were hacked2) CAA entries were removed (I assume google had them -- they do now CAA 0 issue "pki.goog"3) These were then used to verify issuing certificates against major CAs (letsencrypt etc) - for example by creating a new CNAME record for DNS verificationLooking at google.as specifically shows Let's Encrypt issuing a certificate on 2026-09-27https://ctlogs.dev/search?q=google.asGoogle normally issues certificates with "Google Trust Services", presumably their in house CA which all browsers trust, but the only way to limit issuing to Google is with the CAA record.If you hijack DNS, you hijack certificate issuing. As several CAs exist with no business relationship to identify the real person asking for the certificate, you can do this anonymously. (If CAs required verification then you'd just have to chain this with the stolen credentials of someone who uses that CA so wouldn't be a major obstacle)From what I can tell (and the article conflates this with the diginoir so implies it), this was NOT a compromise of a Certificate Authority
  • rswail
    The affected country ccTLDs are:AS: American SamoaGH: GreenlandSL: Sierra Leone
  • chrisjj
    Increasingly it seems domain cert issuance is too important to be left to computers. Shame we have no backup solution.
  • TheChaplain
    I'm just waiting for Claude-powered hackers to break into the dns root system or bgp routing system. It's going to be a wreck :(
  • anon
    undefined
  • fulafel
    From the Google blog "Chrome's Response to Recent ccTLD Registry Hijacks":"These incidents did not involve a compromise of Google’s systems; rather, attackers compromised the third-party ccTLDs, putting any domain ending in .gh, .sl, or .as at risk. During these hijacks, attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains, as well as domains belonging to other organizations."So entire top level domain registries were compromised. Interesting times. Isn't there really any primary source on this?
  • aiXis
    [flagged]
  • netik
    This seems like bullshit given certificate pinning and other countermeasures here. What am I missing ?Is it TLDs lacking support for this?