Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • From the Google blog "Chrome's Response to Recent ccTLD Registry Hijacks":

    "These incidents did not involve a compromise of Google’s systems; rather, attackers compromised the third-party ccTLDs, putting any domain ending in .gh, .sl, or .as at risk. During these hijacks, attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains, as well as domains belonging to other organizations."

    So entire top level domain registries were compromised. Interesting times. Isn't there really any primary source on this?

    by fulafel
  • Increasingly it seems domain cert issuance is too important to be left to computers. Shame we have no backup solution.
    by chrisjj
  • "Web PKI" depends on DNS, specifically "domain names"
    by 1vuio0pswjnm7
  • The affected country ccTLDs are:

    AS: American Samoa

    GH: Greenland

    SL: Sierra Leone

    by rswail
  • So looks like

    1) Top level CC DNS entries were hacked

    2) CAA entries were removed (I assume google had them -- they do now CAA 0 issue "pki.goog"

    3) These were then used to verify issuing certificates against major CAs (letsencrypt etc) - for example by creating a new CNAME record for DNS verification

    Looking at google.as specifically shows Let's Encrypt issuing a certificate on 2026-09-27

    https://ctlogs.dev/search?q=google.as

    Google normally issues certificates with "Google Trust Services", presumably their in house CA which all browsers trust, but the only way to limit issuing to Google is with the CAA record.

    If you hijack DNS, you hijack certificate issuing. As several CAs exist with no business relationship to identify the real person asking for the certificate, you can do this anonymously. (If CAs required verification then you'd just have to chain this with the stolen credentials of someone who uses that CA so wouldn't be a major obstacle)

    From what I can tell (and the article conflates this with the diginoir so implies it), this was NOT a compromise of a Certificate Authority

    by iso1631
  • This sounds like something that HPKP ( https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning ) could have prevented and CAA records ( https://letsencrypt.org/docs/caa/ ) could not. But HPKP is deprecated.
    by Borealid

Explore Birbla archives