[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fX9Ooazvra_MwGCkcFgyYaL4BOs5xZQWuUnbotiv20iU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"78606a6d-33f8-496b-b307-ce5d8e673143","cctld-registry-breaches-enable-dns-hijacking-of-google-domains","4ed6fd76-a5ee-4908-8754-34ee91e763be","ccTLD Registry Breaches Enable DNS Hijacking of Google Domains","Attackers exploited weaknesses in third-party ccTLD registry operators to manipulate DNS records and fraudulently obtain HTTPS certificates for Google-owned domains — a classic supply chain attack where trust in a delegated third party becomes the attack surface. The root cause lies in insufficient security controls at these registries, which act as critical internet infrastructure but may not be held to the same security standards as the organizations whose domains they manage. This matters because even a well-secured organization like Google can have its domains impersonated through no direct fault of its own, undermining the foundational trust model of the web's certificate and DNS ecosystem. The incident highlights that certificate transparency logging and browser-level certificate blocking, while effective reactive measures, are no substitute for proactive security at every link in the DNS chain.","**Immediate actions:**\n- Audit and restrict who has the ability to modify DNS records for your critical domains at the registrar and registry level.\n- Enable Certificate Transparency (CT) log monitoring and alerting to detect unauthorized certificate issuance in near real-time.\n- Contact your domain registrar to enable registry lock (server-side lock) on high-value domains to prevent unauthorized transfers or record changes.\n\n**Long-term improvements:**\n- Conduct formal third-party security assessments of all registrars, registry operators, and DNS providers before entrusting them with critical domain management.\n- Implement DNSSEC on all organizational domains to cryptographically sign DNS records and reduce the risk of unauthorized record modification being accepted by resolvers.\n- Establish contractual security requirements (e.g., MFA, access logging, incident notification SLAs) with all DNS and certificate infrastructure vendors.\n\n**Detection measures:**\n- Subscribe to certificate transparency feeds (e.g., crt.sh, Facebook CT Monitor) and set automated alerts for any certificate issued for your domains.\n- Continuously monitor authoritative DNS records for unexpected changes using automated DNS integrity checking tools.\n- Integrate DNS and PKI anomaly detection into your SIEM to ensure rapid triage when unauthorized changes occur.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 12: Network Infrastructure Management","CIS Control 15: Service Provider Management","NIST SP 800-53 SC-20: Secure Name\u002FAddress Resolution Service (Authoritative Source)","NIST SP 800-53 SC-21: Secure Name\u002FAddress Resolution Service (Recursive or Caching Resolver)","NIST SP 800-53 SA-9: External System Services","NIST CSF ID.SC-2: Suppliers and third-party partners of information systems are identified, prioritized, and assessed","NIST CSF DE.CM-1: The network is monitored to detect potential cybersecurity events","RFC 9162: Certificate Transparency Version 2.0","GDPR Article 32: Security of Processing (for EU-domain operators subject to GDPR)","ITIL 4: Supplier Management Practice",{},"published","2026-10-07T22:20:37.336463+00:00","2026-10-07T22:20:37.185+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-hijack-google-domains-after-breaching-cctld-registries\u002F","hackers-hijack-google-domains-after-breaching-cctld-registries-7f3dc4","Hackers hijack Google domains after breaching ccTLD registries",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",{"slug":56,"name":57,"problem":58},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":60,"name":61,"problem":62},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home."]