Google reported an incident in which attackers managed to obtain TLS certificates for individual Google domains (for example, google.as), online services and large companies in the “.gh”, “.sl” and “.as” zones. The attack was carried out through the compromise of the registrars of national top-level domain zones – “.gh” (Ghana), “.sl” (Sierra Leone) and “.as” (American Samoa), which made it possible to replace the DNS servers for domains in these zones and redirect requests to the attackers’ servers. By redirecting traffic, the attackers were able to confirm ownership of domains and obtain TLS certificates, since after changing the data in DNS, verification requests from certification authorities were sent not to real ones, but to spoofed hosts and processed on them.
Unauthorized receipt of certificates was identified as a result of analysis of Certificate Transparency logs, in which Certification authorities reflect all issued and revoked certificates. Google blocked illegitimate certificates obtained during the attack using the CRLSets mechanism in the Chrome browser, and also achieved the revocation of these certificates by certification authorities. It is not yet disclosed for which domains the fraudulent certificates were issued and which companies suffered from the attack.
To minimize the risks of repeating such incidents, domain owners are recommended to organize constant monitoring of public CT logs (Certificate Transparency) to detect unauthorized issuance of certificates. It is recommended to add CAA (Certification Authority Authorization) records to the DNS, which define the list of certification authorities that are allowed to issue certificates for the specified domain. Exposure of the DNS CAA record will not protect against certificate requests after DNS spoofing, but after DNS control is returned, it will prevent attackers from re-issuing certificates using cached domain ownership verification data.