Cyber threat investigation writeups published today detail a major domain name system registry breach impacting global web traffic. Threat actors subverted authoritative regional top-level domain registries to request valid SSL TLS certificates for major technology platforms.
The infrastructure breach targeted country-code top-level domain ccTLD registries for Ghana .gh, American Samoa .as, and Sierra Leone .sl. Threat actors modified authoritative DNS records to pass domain validation checks, generating 12 valid Let us Encrypt and ZeroSSL certificates for regional Google and YouTube domains. The attack allowed adversaries to conduct man-in-the-middle decryption of user web traffic until Certificate Transparency log monitoring enabled Google to revoke affected certificates and block them in Chrome.
Subverting domain registry infrastructure undermines global public key infrastructure trust boundaries. When threat actors compromise authoritative ccTLD operators, adversaries can generate valid SSL certificates for target domains, enabling stealthy traffic interception without triggering browser security warnings.
– Publish strict Certification Authority Authorization CAA records across all corporate domain portfolios to restrict certificate issuance.
– Implement real-time Certificate Transparency CT log monitoring to detect unauthorized certificate requests across regional domain assets.
– Restrict internal administrative access to corporate domain registrar portals using hardware-based multi-factor authentication.
– Report unverified certificate issuances immediately to issuing Certificate Authorities to force rapid revocation protocols.
Domain infrastructure security demands rigorous CAA record enforcement and continuous Certificate Transparency monitoring to ensure corporate web domains remain protected against registry hijacking. #CodeDefence #Google #DNS #PKI #CertificateTransparency #DomainSecurity #WebSecurity #AppSec
/
