ccTLD hijack let attackers obtain unauthorized HTTPS certificates

Google reported that attackers modified authoritative DNS records in the .gh, .sl and .as zones and obtained unauthorized HTTPS certificates covering several Google domains and domains of other organizations. Chrome blocked the certificates via CRLSets, and Google says its systems were not compromised. Restoring DNS does not restore control over certificate issuance, since CAs may reuse cached domain validation.

• Affected namespaces were .gh, .sl and .as
• Certificates covered several Google domains and other organizations
• Chrome blocked the certificates via CRLSets; revocation is underway
• CAA cannot prevent issuance during an active DNS hijack