Attackers compromised three country-code internet registries and obtained unauthorized security certificates for Google and YouTube domains, Google announced in early October. The hijacked registries were for Ghana, Sierra Leone, and American Samoa. Although Google’s systems were not breached, the unauthorized certificates could have allowed attackers to impersonate Google websites and intercept encrypted user communications. Google blocked the certificates through its Chrome browser and worked with certificate authorities to revoke them across all platforms.
Public records show at least 12 certificates were issued between late September and early October for Google and YouTube domains under the three country registries. Most were issued by Let’s Encrypt, with one from ZeroSSL. The attackers obtained these certificates by manipulating domain name system records during the registry hijacks. Google stated that certificate authorities followed proper procedures and bore no responsibility for the breach. The company also noted that other major organizations were likely targeted in similar attacks but declined to name them.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
