Attackers Compromise Three Country Registries and Obtain Google Certificates

Attackers have taken control of three country-code domain registries and used that position to obtain unauthorized HTTPS certificates for several Google domains. Google disclosed the compromise on October 6, according to The Hacker News, which names .gh and .sl among the three registries.

The mechanism is the part worth understanding. A certificate authority issues a certificate to whoever can show control of a domain, and for a domain under a country registry, that control ultimately runs through the registry. Take the registry, and you can make the case for a certificate that looks entirely legitimate. Google's own account is brief: its systems were not the point of entry. It was the target, and it was not the weak point.

Kai Tanner's Cyber Intel desk has the full reading, and it is worth your time. The certificates are valid. A browser shown one for a Google domain, signed by an authority it trusts, raises no warning at all. Anyone who can also steer a victim's traffic can sit in the middle of that session and read it, with the padlock still showing. Kai also sets out why this reaches well beyond Google: every organisation with a name under those registries inherits the same exposure, and most have never had a reason to think about who runs the registry above them.

That is the quiet lesson in the episode. Companies spend years assessing the cloud provider, the managed security service and the software supplier. The registry that sits above their domain name rarely appears on any vendor list, yet it can decide who is allowed to vouch for them. The padlock, in other words, certifies the certificate. It has never certified the chain of people behind it.

Google says the damage began and ended above its own systems, and nothing in the reporting so far says how long the attackers held that position or whose certificates beyond Google's were affected.

What this means is plain enough. Trust on the internet is built in layers, and the top layer is run by institutions most users and most companies never examine. When one of those institutions is compromised, even the best-defended company in the world can be impersonated, and the company does not need to have done anything wrong.