Google Domains Got Hacked

Summary

Several official-looking domains belonging to Google and other major companies were hijacked—not by breaking into those companies, but by compromising the organizations responsible for three country-code top-level domains: .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa).

Between September 22 and 27, attackers apparently changed the name-server settings for affected domains. This gave them control of those domains’ DNS records, allowing them to redirect traffic and pass automated domain-control checks to obtain more than 100 genuine, trusted SSL/TLS certificates. The certificates covered domains associated with roughly 50 organizations, including Google, YouTube, Apple, Microsoft, Bing, and IBM.

At least one Google-related domain was reportedly redirected to a defaced page. The incident did not mean that ordinary visits to google.com were affected.

How the Domain System Enabled the Attack

• Registries maintain records for all domains under a top-level domain, such as .com or .org.
• Registrars sell domains to customers and communicate requested changes to the registry.
• Name servers point to the DNS records that tell browsers where a domain’s website is hosted.
• Certificate authorities issue certificates after verifying that the requester controls a domain. A valid certificate helps authenticate a site and encrypt the connection.

By compromising the registries, the attackers could change the affected domains’ name servers, control their DNS records, and use that control to obtain certificates. With both DNS control and a trusted certificate, a redirected site could appear legitimate to a browser.

Response and Remaining Risk

Google Chrome added the compromised certificates to a blocklist, so Chrome would block affected sites using them. The narrator says this substantially reduced the immediate risk, but notes that Chrome blocking is not the same as certificate revocation: certificates that have not been formally revoked might still appear valid in other contexts. The narrator argues that all compromised certificates should be revoked.

Some certificates were detected and blocked quickly, while others had been active for about a week. The exact method used to gain access to the registries had not been disclosed. The narrator considers AI-assisted research possible but says there is no evidence that AI directly carried out the attack.

The broader concern is that compromising a registry can undermine trust in every domain it controls; a compromise of a major registry such as Verisign could have far wider consequences. The incident also highlights the fragility of relying on a chain of trusted systems without stronger safeguards.

Guides or Reviews

• Explainer: The video walks through registries versus registrars, DNS and name servers, and how certificate authorities verify domain control.
• No product review or step-by-step user tutorial is presented.

Main speaker/source: ThioJoe, the video’s narrator.