This week Google said attackers had hijacked three country-code registries and used them to obtain security certificates for Google and YouTube addresses. The registries were those for Ghana (.gh), Sierra Leone (.sl) and American Samoa (.as). Google’s own systems were not breached. The Hacker News searched the public certificate logs and found at least 12 certificates covering seven addresses, among them google.com.gh, google.sl and youtube.as. They were issued between September 22 and 27, and all had been revoked by October 1.
My first reaction was a question: how does a registry get hijacked? For years I had assumed that every registry had to meet a minimum security standard. That turns out to be only half true.
Two kinds of registry
A registry is the organization that keeps the master list for one domain ending. Generic endings such as .com and .org are run under a contract with ICANN, the body that coordinates the domain name system. That contract sets technical requirements, and ICANN can enforce it.
Country codes are different. Every two-letter ending belongs to a country or territory, and its rules are set there. ICANN’s own compliance page says it has no contract authority to take compliance action against country-code operators. Some of them have signed voluntary frameworks with ICANN, but those are limited in scope.
So the standard I had in mind exists for one group and not the other. Some country registries are large, well-funded organizations. Others are small. No outside body is required to check either kind.
Who runs these three
The public records kept by IANA, the office that manages the top of the domain system, name the manager of each ending:
- .gh: Network Computer Systems Limited, a company in Accra, Ghana.
- .sl: Sierratel, in Freetown, Sierra Leone.
- .as: AS Domain Registry, in Pago Pago, American Samoa, with a New Jersey firm, GDNS, LLC, listed as its technical contact.
That is three separate organizations, with no shared operator in the records. Yet certificates for all three endings were issued within five days of each other.
What we do not know
The records say who is responsible. They say nothing about how well each registry was secured. Google has not said who the attackers were, how they got in, whether the registries are secure now, or whether any certificate was used against real people. Help Net Security reports that the way in was the third-party operators of the three endings.
It would be unfair to assume any of the three was careless. Determined attackers have broken into far larger organizations. Google also said other well-known brands were affected, and added that “we cannot guarantee that our analysis identified every affected domain.”
Why one registry matters so much
The padlock in your browser depends on a certificate. A certificate authority issues one to whoever can prove control of a domain, usually by placing a record in that domain’s DNS. The registry decides where the DNS for every domain under its ending points. Whoever controls the registry can therefore pass that test for any domain under it.
That is why Google said it had no reason to believe the certificate authorities did anything wrong. The padlock system worked as designed. The layer underneath it did not.
This is not a new idea either. In 2019, Cisco’s Talos researchers described a campaign they called Sea Turtle, which hijacked DNS in the same way. The operator of Greece’s country-code registry acknowledged that year that its network had been compromised.
What you can do about it
For most readers the answer is very little, and that is fine. The certificates have been revoked and Chrome blocks them. Keeping your browser up to date remains the habit that matters.
If you own a domain, Google’s advice is worth following whatever ending you use:
- Watch the certificate logs. Every certificate issued for your domain is recorded in public logs, and there are services that will tell you when a new one appears. One you did not ask for is a warning sign.
- Publish a CAA record. This is a DNS record that names which certificate authorities may issue for your domain. Google notes that it cannot stop an attacker during an active hijack, but it can stop more certificates from being issued once control is restored.
- Know which of your endings are country codes. Popular endings such as .tv, .co, .io and .ai are all country codes. That is not a reason to avoid them. It is a reason to know who runs the ending your site depends on, which IANA lists publicly.
The padlock still means something. It rests on more hands than most of us realized, and not all of them are held to the same standard.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
