Hackers obtain counterfeit TLS certificates for Google and other services

Attackers have managed to obtain counterfeit TLS certificates for Google and a number of other major internet services. According to Ars Technica, the root cause was the compromise of three domain registries, which allowed the certificates to be issued without the consent of the domains' legitimate owners.

TLS certificates underpin secure connections across the internet: they confirm that the site a browser is talking to really belongs to the claimed owner, and they enable traffic encryption. A forged but formally valid certificate undermines this trust mechanism — it can be used to intercept or impersonate encrypted traffic while the connection still looks entirely legitimate to the user.

The crucial detail here is where the failure occurred. The breach did not hit the certificate authorities directly, but the domain registries — the infrastructure that domain-ownership checks rely on during certificate issuance. By gaining control over the relevant data, the attackers were able to pass validation and walk off with certificates for domains they did not own, including ones belonging to Google.

The incident is another reminder of how fragile the web's chain of trust remains: compromising a single intermediate link is enough to cast doubt on the authenticity of connections to the largest services that millions of people use every day.

Source: Ars Technica