谷歌周二称，攻击者控制了三个顶级域名，并利用其权限为谷歌及其他大型机构制作了伪造的TLS证书。
Attackers hijacked three top-level domains and used their control to mint counterfeit TLS certificates for Google and other large organizations, Google said Tuesday.
攻击者对.gh、.sl和.as这三个国家代码顶级域名发起了系列攻击，随后修改了这些域名空间内特定域名的权威DNS记录。借助对这些DNS记录的控制权，攻击者成功通过了自动化的域名控制权验证程序，从而获取了“多个谷歌域名”以及“多家全球知名品牌和常用在线服务”的未经授权证书。谷歌表示，已更新Chrome浏览器以拦截所有被识别为未经授权的证书，同时与证书颁发机构协作，确保所有涉及谷歌服务的非法证书均被撤销。
The attackers launched a series of attacks on the .gh, .sl, and .as country code top-level domains (ccTLDs) and then modified authoritative DNS records for selected domains within those namespaces. By controlling those DNS records, the attackers were able to pass automated domain control validation checks and obtain unauthorized certificates for “several Google domains” and “several leading global brands and widely used online services.”Google said it updated Chrome to block all certificates it identified as unauthorized, and worked with the issuing certification authorities to ensure the unauthorized certificates for Google properties were revoked.
TLS证书属于加密凭证，是保障网站、邮件服务器及其他互联网基础设施身份认证与加密安全的核心要素。这类x.509证书通过数字签名将google.com这类域名与对应的公钥绑定。公钥可公开获取，而私钥仅由网站运营方掌握。当连接验证显示密钥匹配时，访问者即可确认自己连接的是真实站点而非冒名顶替者。若攻击者持有此类未经授权的证书，便可利用加密技术冒充相关互联网基础设施。
TLS certificates are the cryptographic credentials that underpin authentication and encryption protections for websites, mail servers, and other Internet infrastructure. These x.509 certificates use a digital signature to bind a domain name such as google.com to a public key. The public key is publicly available, while the private key is held only by the website operator. When a connection shows that the keys match, the visiting party knows it’s connected to the authentic site rather than an impostor. Possession of unauthorized certificates allows attackers to cryptographically impersonate the affected infrastructure.