Definition
DNS hijacking is an attack where adversaries gain control over authoritative DNS for a domain or entire TLD, redirecting traffic or passing domain-validation checks to obtain fraudulent TLS certificates.
Key Points
- 2026-10-06: Attackers hijacked .gh, .sl, .as ccTLD registries; obtained unauthorized DV TLS certs for google and other brands via cctld-registry-hijack (2026-10-07-google-cctld-hijack-chrome-response)
- CAs issued certs correctly — attackers controlled DNS and passed validation
- Precedents: Sea Turtle campaign (2017–2019), US federal DNS tampering (2019)
- Mitigations: certificate-transparency monitoring, CAA records, domain audits for affected TLDs
Related
- cctld-registry-hijack
- tls-certificates
- pki-infrastructure
- domain-validation
- certificate-transparency
- application-security