What happened
Attackers hijacked top level domains and used that control to alter DNS records and obtain fraudulent HTTPS certificates for several Google domains as well as domains belonging to other organizations. Google said it became aware of the series of attacks last week, affecting the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) country code namespaces.
Google said that during the hijacks, attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains and domains belonging to other organizations. It did not say which domains or organizations were affected. The company said the attacks did not compromise Google systems, that Chrome quickly blocked suspected counterfeit certificates across the affected country code top level domains, and that there is no reason to believe the certification authorities that issued the impacted certificates did anything wrong.
The consequence is impersonation without the usual browser warning. Because the attacker controls both traffic routing and the private key attached to the unauthorized certificate, they can intercept or modify data sent to the impersonated site, and use a trusted brand to run phishing campaigns.
Google was direct about the limits of its own intervention. It said browser side action should not be relied on to protect users, that due to the complexity of DNS hijacks it cannot guarantee its analysis identified every affected domain, and that Chrome's interventions do not reliably protect people using other browsers. Its recommendations are ongoing monitoring of Certificate Transparency logs across all domains, including parked and regional country code properties, a review of recent CT log entries for organizations in .gh, .sl or .as, and restrictive Certification Authority Authorization records naming which authorities may issue certificates.
Why this is a GRC story
Domain and certificate assets are governance scope. Many organizations have domains registered years ago for a redirect or brand protection, and nobody currently owns them. Those are exactly the properties Google points at. An asset register that covers servers but not DNS zones has a blind spot at the trust layer, where users cannot tell the real site from a copy.
Certificate Transparency is a free early warning system. Monitoring CT logs gives near real time notice when a certificate is issued for a domain you control. It is one of the few detective controls that costs almost nothing and produces high value alerts.
Trust in a third party is not the same as assurance. Google did not blame the certification authorities. The lesson is structural: certificate issuance validation can be undermined by whoever controls the DNS answers at that moment. Registrars, DNS providers and certificate authorities each deserve a named owner.
What to watch
Watch whether the affected registries and registrars publish details on how authoritative records were changed, because that determines whether this was a registry compromise, an account takeover at a registrar, or a weakness in delegation. Watch also for whether the industry revisits cached validation state, which Google warns can be used to mint certificates after a hijack ends.
The practical actions are small and repeatable. List every domain you own, including the ones nobody uses, confirm which DNS provider holds each zone, turn on Certificate Transparency monitoring, publish CAA records that restrict issuance, and protect registrar accounts with strong authentication.
Attribution: Analysis based on The Register and related public reporting. This article is original commentary, not a repost of the source material.