想象一下，你通过正确的 URL 访问谷歌网站，结果却被重定向到犯罪分子的非法复制网站。攻击者劫持了顶级域名，从而能够篡改 DNS 记录，并为多个谷歌域名以及其他组织的域名生成虚假的 HTTPS 证书。谷歌表示，他们于上周发现了这一系列攻击，这些攻击发生在 .gh（加纳）、.sl（塞拉利昂）和 .as（美属萨摩亚）等国家代码顶级域名（ccTLD）中。
Imagine going to a Google website at its correct URL, only to be redirected to a crim's illegitimate copy. Attackers hijacked top-level domains, allowing them to alter DNS records and mint fraudulent HTTPS certificates for several Google domains, and those belonging to other organizations. Google said it became aware of the series of attacks last week in the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) country-code top-level namespaces (ccTLDs).
谷歌安全团队周二警告称：“在这些劫持事件中，攻击者修改了权威 DNS 记录，并获得了未经授权的 HTTPS 证书，这些证书覆盖了多个谷歌域名以及其他组织的域名。”谷歌并未说明具体受影响的域名或组织。据“巧克力工厂”称，这些攻击并未破坏谷歌的系统，而 Chrome 也迅速在受影响的 ccTLD 中拦截了疑似伪造的证书——这意味着 Chrome 浏览器用户已经得到了保护。
“During these hijacks, attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains, as well as domains belonging to other organizations,” Google security warned on Tuesday. Google did not say which specific domains or organizations were affected. The attacks did not compromise Google’s systems, and Chrome quickly blocked suspected counterfeit certificates across the affected ccTLDs - meaning Chrome browser users are already protected - according to the Chocolate Factory.
该警告指出：“鉴于这些攻击的性质，我们没有理由认为签发受影响证书的认证机构（CA）存在任何不当行为。”这类攻击使犯罪分子能够在不触发任何浏览器安全警报的情况下，冒充合法组织和网站。攻击者控制着流量路由（通过 DNS）以及与未经授权证书关联的私钥，这意味着他们有可能拦截或篡改用户发送到被冒充网站的数据，并利用受信任组织的品牌来分发恶意软件或实施网络钓鱼攻击。
“Due to the nature of the attacks, we have no reason to believe the Certification Authorities (CAs) that issued the impacted certificates did anything wrong,” the alert said. These types of attacks allow criminals to impersonate legitimate organizations and websites without triggering any browser security alerts. The attacker controls the traffic routing (via DNS) and the private key associated with the unauthorized certificate, which means they can potentially intercept or modify data sent by users to the impersonated site - and abuse the trusted organization's brand to distribute malware or conduct phishing attacks.
谷歌警告域名所有者称：“尽管在这些事件期间，Chrome 已采取措施识别并拦截受影响 ccTLD 中的疑似未经授权证书，但不应依赖浏览器端的干预来保护您的用户。”
“While Chrome took steps during these incidents to identify and block suspected unauthorized certificates across the affected ccTLDs, browser-side intervention should not be relied on to protect your users,” Google warned domain owners.
“由于 DNS 劫持的复杂性，我们无法保证分析能够识别出所有受影响的域名，而且 Chrome 的干预措施也无法可靠地保护非 Chrome 用户。”为确保其域名和用户的网络安全，Google 建议持续监控组织所有域名（包括已停放或区域性 ccTLD 域名）的证书透明度（CT）日志。这样可以在任何人获取您某个域名的证书时，提供近乎实时的警报。
“Due to the complexity of DNS hijacks, we cannot guarantee that our analysis identified every affected domain, nor do Chrome interventions reliably protect non-Chrome users.”To ensure that their domains and users are protected, Google recommends ongoing monitoring of Certificate Transparency (CT) logs across all of an organization’s domains, including parked or regional ccTLD properties. This provides near real-time alerts whenever someone obtains a certificate for one of your domains.
如果您运营的是 .gh、.sl 或 .as 域名，务必检查近期的 CT 日志条目，确认是否存在意外证书。组织还可以发布限制性的证书签发机构授权（CAA）DNS 记录，允许域名所有者指定哪些证书签发机构可以为其域名签发证书。虽然这无法阻止在 DNS 劫持攻击期间证书的签发，但有助于在 DNS 控制权恢复后保护域名。
And if you operate a domain in .gh, .sl, or .as, definitely review recent CT log entries for unexpected certificates. Organizations can also publish restrictive Certification Authority Authorization (CAA) DNS records, which allow domain owners to specify which CAs are permitted to issue certificates for their domains. While this won’t stop certificates from being issued during a DNS hijacking attack, it helps safeguard domains after DNS control is restored.
Google 建议采用限制证书签发至特定授权账户和验证方式的 CAA 策略，以防止攻击者在劫持结束后利用缓存的验证状态签发新证书。®
Google recommends CAA policies that restrict issuance to specific authorized accounts and validation methods and prevent attackers from using cached validation state to mint new certificates after a hijacking ends.®