{"id":20600,"date":"2026-10-07T12:05:42","date_gmt":"2026-10-07T12:05:42","guid":{"rendered":"https:\/\/news.theck1.no\/?p=20600"},"modified":"2026-10-07T12:05:42","modified_gmt":"2026-10-07T12:05:42","slug":"hackers-obtain-counterfeit-tls-certificates-for-google-and-other-large-services","status":"publish","type":"post","link":"https:\/\/news.theck1.no\/?p=20600","title":{"rendered":"Hackers obtain counterfeit TLS certificates for Google and other large services"},"content":{"rendered":"

AI-rewritten:<\/strong> This is a summary of an article from Ars Technica, rewritten by AI (Qwen, running locally) to make it easier to read. The facts come from the original article – read it for the full story.<\/p>\n

Ars Technica •
\n Dan Goodin
\n • October 6, 2026<\/strong><\/div>\n\n

Hackers hijacked three top-level domains and used that control to create counterfeit TLS certificates for Google and other major organizations, according to Google. The attackers modified authoritative DNS records for selected domains within the .gh, .sl, and .as country code namespaces. This allowed them to pass automated domain control validation checks and issue unauthorized certificates for several Google domains and other leading global brands. Google stated it updated Chrome to block all identified unauthorized certificates and worked with certification authorities to revoke those issued for Google properties.<\/p>\n

<\/p>\n

TLS certificates are cryptographic credentials that bind a domain name to a public key, ensuring visitors connect to the authentic site rather than an impostor. Possession of these unauthorized certificates allows attackers to cryptographically impersonate affected infrastructure. While Chrome users do not need to take action to be protected, Google cautioned domain owners not to rely solely on browser-side interventions. The company advised monitoring certificate transparency logs and publishing restrictive Certification Authority Authorization DNS records to prevent attackers from reusing cached validation data after DNS control is restored.<\/p>\n

Google noted the incident did not involve the compromise of any affected domain owner’s infrastructure or certificate authority requirements. With control of the three ccTLDs, attackers changed IP addresses and modified nameserver delegations for selected websites, enabling them to send and receive traffic while passing industry validation checks. This follows a 2011 hack of DigiNotar that minted counterfeit certificates for Google.com and over 200 other domains, affecting at least 300,000 people. Although all known unauthorized certificates are now blocked, any undiscovered certificates remain a threat.<\/p>\n

\n

Source:<\/strong> Ars Technica •
\n Dan Goodin
\n • October 6, 2026<\/p>\n

Read the original article at Ars Technica →<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

AI-rewritten: This is a summary of an article from Ars Technica, rewritten by AI (Qwen, running locally) to make it easier to read. The facts come from the original article – read it for the full story. Ars Technica • Dan Goodin • October 6, 2026 Hackers hijacked three top-level domains and used that control<\/p>\n

READ MORE<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-20600","post","type-post","status-publish","format-standard","hentry","category-artificial-intelligence"],"_links":{"self":[{"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/posts\/20600","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news.theck1.no\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=20600"}],"version-history":[{"count":0,"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/posts\/20600\/revisions"}],"wp:attachment":[{"href":"https:\/\/news.theck1.no\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=20600"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news.theck1.no\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=20600"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news.theck1.no\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=20600"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}