Attackers have exploited vulnerabilities in three domain registries, successfully obtaining SSL certificates for Google domains. The impacted registries are those responsible for .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). This breach has significant implications for Google’s secure certificate infrastructure and its users.
The attackers’ approach was to compromise the registrars’ systems, allowing them to request and obtain SSL certificates from a trusted Certificate Authority. These certificates are typically used to verify the identity of websites and ensure that communication between a user’s browser and the site is encrypted. By obtaining these certificates for Google domains, attackers gained the ability to impersonate legitimate sites and conduct phishing attacks or other malicious activities.
The process by which attackers exploited this vulnerability is relatively straightforward. They targeted registrars’ systems responsible for managing domain name registrations. Once inside, they were able to request SSL certificates on behalf of Google’s domains, bypassing traditional validation procedures that typically ensure the requesting party is authorized to obtain such certificates. This manipulation allowed them to create forged certificates that appeared legitimate.
This breach has critical implications for online security and identity management. The compromised registries are not only responsible for managing their respective country-code top-level domains but also provide a gateway for trusted certificate issuance. With attackers now able to request SSL certificates on behalf of Google’s domains, the company’s ability to maintain secure communication channels is severely undermined.
The incident highlights weaknesses in the way domain registries and Certificate Authorities interact. Traditionally, this interaction relies heavily on trust relationships between these organizations. However, as demonstrated by this attack, such relationships can be exploited if not properly secured. The compromised registries’ lack of robust security measures allowed attackers to execute this sophisticated manipulation.
The aftermath of this breach will likely involve a thorough review of the affected domain registries and Certificate Authorities’ internal controls. As the cybersecurity landscape continues to evolve, it’s crucial for organizations responsible for managing secure certificate issuance to remain vigilant against such exploits. For users, this incident underscores the importance of verifying certificate authenticity before establishing trust with online services.
Practically speaking, if you’re a Google domain owner or administrator, now is an ideal time to review your SSL certificates’ validity and ensure they match the information provided by your registrar. Even more broadly, maintaining awareness about certificate authenticity and performing regular security audits can help mitigate risks associated with such attacks in the future.
Source: The Hacker News — 2026-10-07