Hackers obtain counterfeit TLS certificates for Google and other large services

“While Chrome took steps during these incidents to identify and block suspected unauthorized certificates across the affected ccTLDs, browser-side intervention should not be relied on to protect your users,” Google said. “Due to the complexity of DNS hijacks, we cannot guarantee that our analysis identified every affected domain, nor do Chrome interventions reliably protect non-Chrome users.”

It’s not immediately clear what the other affected organizations are, how many unauthorized certificates were issued, or if they have been revoked. The process for officially revoking certificates in browsers is slow and cumbersome, so certificate authorities and other stakeholders have devised a quicker method to block specific certificates at the browser level. With all known unauthorized certificates now blocked, the risk is mitigated, but as Google noted, any certificates that remain undiscovered pose a threat.

Google noted that the incident didn’t involve the compromise of the infrastructure of any of the affected domain owners or the DNS operators. With control of the three ccTLDs, the attackers were able to change the IP addresses of a selected list of websites. With the ability to send and receive traffic on those sites, the attackers were able to pass CA tests requiring an applicant to prove it has control of the underlying domain.

This isn’t the first time threat actors have obtained unauthorized certificates. A 2011 hack of Netherlands-based certificate authority DigiNotar allowed attackers to mint counterfeit certificates for Google.com and more than 200 other high-traffic domains. The certificates were used against at least 300,000 people with ties to Iran as they browsed the sites impersonated by the forged certificates. There have been many similar incidents since, most often through failures by certificate authorities but also domain holders.