From the Google blog "Chrome's Response to Recent ccTLD Registry Hijacks":
"These incidents did not involve a compromise of Google’s systems; rather, attackers compromised the third-party ccTLDs, putting any domain ending in .gh, .sl, or .as at risk. During these hijacks, attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains, as well as domains belonging to other organizations."
So entire top level domain registries were compromised. Interesting times. Isn't there really any primary source on this?
This sounds like something that HPKP ( https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning ) could have prevented and CAA records ( https://letsencrypt.org/docs/caa/ ) could not. But HPKP is deprecated.
The affected country ccTLDs are:
AS: American Samoa
GH: Greenland
SL: Sierra Leone
.gh is Ghana, not Greenland
From the Google blog "Chrome's Response to Recent ccTLD Registry Hijacks":
"These incidents did not involve a compromise of Google’s systems; rather, attackers compromised the third-party ccTLDs, putting any domain ending in .gh, .sl, or .as at risk. During these hijacks, attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains, as well as domains belonging to other organizations."
So entire top level domain registries were compromised. Interesting times. Isn't there really any primary source on this?
Nothing novel about this. In fact this is the reason why years ago Google stopped using ccTLDs to serve their website.
Other recent submissions include the link to google's blog at https://blog.google/security/chromes-response-to-recent-cctl... :
https://news.ycombinator.com/item?id=49988253
https://news.ycombinator.com/item?id=49981886
This seems like bullshit given certificate pinning and other countermeasures here. What am I missing ?
Is it TLDs lacking support for this?