Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
- ID
- 32959
- Status
- summarized
- Published
- 08 Oct 2026, 2:48 AM
- Fetched
- 08 Oct 2026, 5:15 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/attackers-hijack-gh-sl-and-as.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 5.5
- Created
- 08 Oct 2026, 5:17 AM
- Tags
- Audience
- developerssaas_founders
What happened
Google disclosed on October 6, 2026 that attackers hijacked the registries for three country-code TLDs — .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) — and used changed authoritative DNS records to obtain unauthorized HTTPS certificates for Google and YouTube domains. Certificate Transparency logs show at least 12 domain-validated certificates issued between September 22 and 27 for seven domains, including google.com.gh, google.sl and google.as; 11 came from Let's Encrypt and one from ZeroSSL, with one ccTLD hit per day (.gh Sept 22, .sl Sept 25, .as Sept 27). Chrome blocked the Google-domain certificates via CRLSets and Google worked with the CAs to revoke them; Google said its own systems were not breached and it has no reason to believe the CAs did anything wrong. Let's Encrypt staff member Matthew McPherrin confirmed on the CA's forum on October 7 that the certificates 'were issued, and have been revoked.'
Why it matters
Every one of the 12 certificates was domain-validated, meaning a CA only checked that the applicant controlled DNS — so if your DNS or registrar account is compromised, an attacker can get a browser-trusted cert for your domain without ever touching your servers. The detection path here was Certificate Transparency logs (ctlogs.dev, Cert Spotter), not the CAs, so the concrete action is to set up CT-log alerts for the domains you ship on and lock down registrar/DNS credentials; also check whether you rely on a ccTLD whose registry you cannot audit, since Google only names .gh, .sl and .as as affected.
Discussion angle
Walk through the DV trust model: a valid padlock only proves DNS control at issuance time, so ask the room who actually monitors CT logs for their own domains — and whether registry-level hijack is a realistic threat for a small team versus the more likely risk of a compromised registrar login.