GOOGLE DIDN’T GET HACKED. DNS DID.
Need real domain certificates for Google domains? Contact hackers. They didn't even need to hack the company's servers to bypass the usual protections. We're serious here. Hackers were able to seize control of three national domain zones and obtain valid certificates for Google addresses and other services.
Google officially announced that the hacker attacks affected .gh, .sl, and .as. However, the company's own systems weren't even compromised. The attackers targeted the domain zone registries of Ghana, Sierra Leone, and American Samoa. The attackers simply changed the authoritative DNS records and name server delegations for the selected domains, redirecting the verification traffic to their own infrastructure. This established control allowed the hackers to pass standard domain ownership verification and request a certificate from a trusted certification authority. The certification authorities themselves, however, did not violate any rules. The fact is, their verification showed that the applicant truly controlled the address. A valid TLS certificate seamlessly verifies the domain to the browser and enables an encrypted connection. Later, during the investigation, Certificate Transparency logs helped uncover certificates that their legitimate owners had not requested. Researchers examined the public logs and found at least 12 certificates for seven Google and YouTube addresses, issued between September 22 and 27. Eleven were issued by Let's Encrypt, another ZeroSSL provider. The addresses included google.com.gh, google.sl, google.com.sl, google.as, and YouTube domains in the same national extensions. By October 7, all 12 certificates were already listed as revoked. Following the incident, Chrome immediately blocked the identified Google certificates via CRLSets, and CAs revoked them to protect users of other clients. CT data then pointed to certificates from several major brands and popular online services, and Chrome added the known examples to its block list. Google representatives did not officially name other organizations or say whether the certificates were used in real attacks. What we want to say is that the danger of such certificates is that a browser can mistake an attacker's server for a legitimate one, and then establish an encrypted connection with it without the usual warning. Control over DNS, coupled with a valid certificate, creates the conditions for convincingly spoofing a website and instantly intercepting traffic. However, Google cannot guarantee that it has found every affected domain. Mad wars are decisively moving into cyberspace.