[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXbVbaQVDC2iCH7okAVPWUwtZLSHC1bVzIOn3DYLP1NI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":31,"created_at":32,"published_at":33,"article":34,"tags":38,"podcasts":51,"controls":52},"60948993-027b-45cf-8e1d-23522e32334c","cctld-hijacks-expose-dns-and-certificate-authority-weaknesses","91c5a5e6-db21-43de-9f03-01070f7db7af","ccTLD Hijacks Expose DNS and Certificate Authority Weaknesses","Attackers exploited weaknesses at the country-code top-level domain (ccTLD) registry level to modify DNS records and fraudulently obtain HTTPS certificates for Google and other organizations' domains — without ever compromising those organizations directly. This illustrates that even well-resourced companies are vulnerable to infrastructure they do not control, such as upstream registries and certificate authorities. The attack undermines trust in core internet security mechanisms, including HTTPS and PKI. Without proactive monitoring of Certificate Transparency logs and restrictive CAA records, domain owners may not detect unauthorized certificate issuance until significant damage is done.","**Immediate actions:**\n- Add restrictive CAA (Certification Authority Authorization) DNS records to explicitly limit which CAs are authorized to issue certificates for your domains.\n- Subscribe to Certificate Transparency log monitoring services (e.g., crt.sh, Google's Cert Spotter) to receive alerts for any unauthorized certificate issuance.\n\n**Long-term improvements:**\n- Implement DNSSEC signing for all organizational domains to cryptographically protect DNS records from unauthorized modification.\n- Establish a formal domain asset inventory and assign ownership responsibility for all registered domains, including country-code variants.\n- Work with domain registrars to enable registry lock services that require out-of-band verification before DNS changes are permitted.\n\n**Detection measures:**\n- Configure automated alerting for unexpected changes to DNS records across all owned domains.\n- Integrate Certificate Transparency log feeds into your SIEM to correlate unauthorized certificate events with other anomalous activity.",[12,13,14,15,16,17,18,19,20],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 8 – Audit Log Management","NIST SP 800-81-2 – Secure Domain Name System (DNS) Deployment Guide","NIST CSF DE.CM-7 – Monitoring for Unauthorized Activity","NIST SP 800-57 – Key Management (PKI\u002FCertificate Lifecycle)","RFC 8659 – DNS Certification Authority Authorization (CAA)","RFC 6962 – Certificate Transparency","ITIL – Service Configuration Management",{"RFC 6962 – Certificate Transparency":22,"CIS Control 8 – Audit Log Management":23,"ITIL – Service Configuration Management":24,"NIST CSF DE.CM-7 – Monitoring for Unauthorized Activity":25,"CIS Control 4 – Secure Configuration of Enterprise Assets":26,"CIS Control 1 – Inventory and Control of Enterprise Assets":27,"RFC 8659 – DNS Certification Authority Authorization (CAA)":28,"NIST SP 800-57 – Key Management (PKI\u002FCertificate Lifecycle)":29,"NIST SP 800-81-2 – Secure Domain Name System (DNS) Deployment Guide":30},"Certificate Transparency logs let organisations detect fraudulent HTTPS certificates issued for their domains.","Logging DNS and certificate changes helps detect unauthorised modifications quickly.","Configuration management of DNS records helps detect and reverse unauthorised changes.","Monitoring for unauthorised activity includes watching for unexpected DNS changes and certificate issuance.","Secure configuration includes registry locks and DNSSEC where available, reducing the risk of DNS tampering.","An inventory of domains and DNS assets helps organisations monitor critical domains, including those under ccTLDs.","CAA records limit which certificate authorities may issue for a domain, adding a check against fraudulent certificates.","Certificate lifecycle management includes monitoring for unauthorised certificates issued for your domains.","Secure DNS deployment guidance covers DNSSEC and registry protections relevant to ccTLD hijacking.","published","2026-10-09T12:20:22.587893+00:00","2026-10-09T12:20:22.268+00:00",{"id":7,"url":35,"slug":36,"title":37},"https:\u002F\u002Fwww.securityweek.com\u002Fgoogle-domains-impacted-by-recent-cctld-domain-hijacks\u002F","google-domains-impacted-by-recent-cctld-hijacks-9fbb49","Google Domains Impacted by Recent ccTLD Hijacks",[39,45],{"id":40,"name":41,"slug":42,"description":43,"color":44},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":46,"name":47,"slug":48,"description":49,"color":50},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[53,57],{"slug":54,"name":55,"problem":56},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",{"slug":58,"name":59,"problem":60},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home."]