Attackers hijack country-code domains to impersonate Google and other services

What happened

According to Google , attackers compromised infrastructure behind three country-code domain namespaces— .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa)—and used it to obtain unauthorized HTTPS certificates for Google domains and other organizations. Instead, attackers manipulated the internet’s addressing infrastructure so they could pass the checks required to obtain certificates for domains they didn’t legitimately control. Google is an Internet and internet marketing company based in Mountain View.

Cybercriminals compromised three country-code namespaces to get certificates that could help them impersonate trusted sites. These domain endings aren’t limited to sites serving those countries, so the risk can extend to users elsewhere.

This wasn’t a break in encryption (scrambling data so only the holder of the key can read it), and Google’s systems weren’t compromised. The Domain Name System (DNS (the system that turns a domain name into an address)) helps direct internet traffic to the right destination.