{"id":7078763,"date":"2026-10-07T01:39:15","date_gmt":"2026-10-07T01:39:15","guid":{"rendered":"https:\/\/fivemor.com\/?p=7078763"},"modified":"2026-10-07T01:39:15","modified_gmt":"2026-10-07T01:39:15","slug":"hackers-obtain-counterfeit-tls-certificates-for-google-and-other-large-services","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=7078763","title":{"rendered":"Hackers obtain counterfeit TLS certificates for Google and other large services"},"content":{"rendered":"<p> <br \/>\n<br \/><img decoding=\"async\" src=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2026\/10\/broken-https-tls-1152x648.jpg\" \/><\/p>\n<div>\n<p>\u201cWhile Chrome took steps during these incidents to identify and block suspected unauthorized certificates across the affected ccTLDs, browser-side intervention should not be relied on to protect your users,\u201d Google <a href=\"https:\/\/blog.google\/security\/chromes-response-to-recent-cctld-registry-hijacks\/\">said<\/a>. \u201cDue to the complexity of DNS hijacks, we cannot guarantee that our analysis identified every affected domain, nor do Chrome interventions reliably protect non-Chrome users.\u201d<\/p>\n<p>It\u2019s not immediately clear what the other affected organizations are, how many unauthorized certificates were issued, or if all of them, except for those for Google domains, have been blocked. The process for officially revoking certificates is slow and cumbersome, so browser makers have devised quicker methods to block specific certificates at the browser level. With all known unauthorized certificates now blocked, the risk is mitigated, but as Google noted, any certificates that remain undiscovered pose a threat.<\/p>\n<p>Google noted that the incident didn\u2019t involve the compromise of the infrastructure of any of the affected domain owners and that certificate authorities followed all requirements. With control of the three ccTLDs, the attackers were able to change the IP addresses of a selected list of websites. With the ability to send and receive traffic on those sites, the attackers were able to modify authoritative DNS records and nameserver delegations for selected domains, allowing them to pass industry validation checks requiring an applicant to prove control of the domain.<\/p>\n<p>This isn\u2019t the first time threat actors have obtained unauthorized certificates. A <a href=\"http:\/\/www.theregister.co.uk\/2011\/08\/29\/fraudulent_google_ssl_certificate\/\">2011 hack<\/a> of Netherlands-based certificate authority DigiNotar allowed attackers to mint counterfeit certificates for Google.com and more than 200 other high-traffic domains. The certificates were used against at least 300,000 people with ties to Iran as they browsed the sites impersonated by the forged certificates. There have been many similar incidents since, <a href=\"https:\/\/arstechnica.com\/information-technology\/2025\/09\/the-number-of-mis-issued-1-1-1-1-certificates-grows-heres-the-latest\/\">most<\/a> <a href=\"https:\/\/arstechnica.com\/information-technology\/2015\/03\/google-warns-of-unauthorized-tls-certificates-trusted-by-almost-all-oses\/\">often<\/a> <a href=\"https:\/\/arstechnica.com\/information-technology\/2017\/01\/already-on-probation-symantec-issues-more-illegit-https-certificates\/\">through<\/a> failures <a href=\"https:\/\/arstechnica.com\/information-technology\/2012\/02\/critics-slam-ssl-authority-for-minting-cert-used-to-impersonate-sites\/\">by<\/a> <a href=\"https:\/\/arstechnica.com\/information-technology\/2013\/12\/french-agency-caught-minting-ssl-certificates-impersonating-google\/\">certificate<\/a> <a href=\"https:\/\/arstechnica.com\/information-technology\/2014\/07\/crypto-certificates-impersonating-google-and-yahoo-pose-threat-to-windows-users\/\">authorities<\/a> but also <a href=\"https:\/\/arstechnica.com\/information-technology\/2015\/03\/bogus-ssl-certificate-for-windows-live-could-allow-man-in-the-middle-hacks\/\">domain holders<\/a>.<\/p>\n<\/p><\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>\u201cWhile Chrome took steps during these incidents to identify and block suspected unauthorized certificates across the affected ccTLDs, browser-side intervention should not be relied on to protect your users,\u201d Google said. \u201cDue to the complexity of DNS hijacks, we cannot guarantee that our analysis identified every affected domain, nor do Chrome interventions reliably protect non-Chrome [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":7078764,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[108292,132003,239424,239425,101235,239426,239427],"tags":[33666,23016,1531,12712,847,20153,4834,67514],"dealstore":[],"offerexpiration":[],"class_list":["post-7078763","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-biz-it","category-browser","category-certificate","category-certificate-authority","category-security","category-tls","category-transport-layer-security","tag-certificates","tag-counterfeit","tag-google","tag-hackers","tag-large","tag-obtain","tag-services","tag-tls"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Hackers obtain counterfeit TLS certificates for Google and other large services - Som2ny Network<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fivemor.com\/?p=7078763\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hackers obtain counterfeit TLS certificates for Google and other large services - Som2ny Network\" \/>\n<meta property=\"og:description\" content=\"\u201cWhile Chrome took steps during these incidents to identify and block suspected unauthorized certificates across the affected ccTLDs, browser-side intervention should not be relied on to protect your users,\u201d Google said. \u201cDue to the complexity of DNS hijacks, we cannot guarantee that our analysis identified every affected domain, nor do Chrome interventions reliably protect non-Chrome [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fivemor.com\/?p=7078763\" \/>\n<meta property=\"og:site_name\" content=\"Som2ny Network\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-07T01:39:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2026\/10\/broken-https-tls-1152x648.jpg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fivemor.com\/?p=7078763#article\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/?p=7078763\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\"},\"headline\":\"Hackers obtain counterfeit TLS certificates for Google and other large services\",\"datePublished\":\"2026-10-07T01:39:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=7078763\"},\"wordCount\":312,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/?p=7078763#primaryimage\"},\"thumbnailUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/broken-https-tls-1152x648.jpg\",\"keywords\":[\"certificates\",\"Counterfeit\",\"Google\",\"Hackers\",\"Large\",\"Obtain\",\"Services\",\"TLS\"],\"articleSection\":[\"Biz &amp; IT\",\"Browser\",\"certificate\",\"certificate authority\",\"Security\",\"tls\",\"transport layer security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fivemor.com\/?p=7078763#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fivemor.com\/?p=7078763\",\"url\":\"https:\/\/fivemor.com\/?p=7078763\",\"name\":\"Hackers obtain counterfeit TLS certificates for Google and other large services - Som2ny Network\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=7078763#primaryimage\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/?p=7078763#primaryimage\"},\"thumbnailUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/broken-https-tls-1152x648.jpg\",\"datePublished\":\"2026-10-07T01:39:15+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fivemor.com\/?p=7078763#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fivemor.com\/?p=7078763\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/?p=7078763#primaryimage\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/broken-https-tls-1152x648.jpg\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/broken-https-tls-1152x648.jpg\",\"width\":1152,\"height\":648},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fivemor.com\/?p=7078763#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/fivemor.com\/?bp_activities=1\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hackers obtain counterfeit TLS certificates for Google and other large services\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fivemor.com\/#website\",\"url\":\"https:\/\/fivemor.com\/\",\"name\":\"Som2ny Network\",\"description\":\"Daily Deals\",\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fivemor.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/fivemor.com\/#organization\",\"name\":\"Som2ny Network\",\"url\":\"https:\/\/fivemor.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"width\":300,\"height\":86,\"caption\":\"Som2ny Network\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/fivemor.com\"],\"url\":\"https:\/\/fivemor.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hackers obtain counterfeit TLS certificates for Google and other large services - Som2ny Network","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fivemor.com\/?p=7078763","og_locale":"en_US","og_type":"article","og_title":"Hackers obtain counterfeit TLS certificates for Google and other large services - Som2ny Network","og_description":"\u201cWhile Chrome took steps during these incidents to identify and block suspected unauthorized certificates across the affected ccTLDs, browser-side intervention should not be relied on to protect your users,\u201d Google said. \u201cDue to the complexity of DNS hijacks, we cannot guarantee that our analysis identified every affected domain, nor do Chrome interventions reliably protect non-Chrome [&hellip;]","og_url":"https:\/\/fivemor.com\/?p=7078763","og_site_name":"Som2ny Network","article_published_time":"2026-10-07T01:39:15+00:00","og_image":[{"url":"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2026\/10\/broken-https-tls-1152x648.jpg","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fivemor.com\/?p=7078763#article","isPartOf":{"@id":"https:\/\/fivemor.com\/?p=7078763"},"author":{"name":"admin","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371"},"headline":"Hackers obtain counterfeit TLS certificates for Google and other large services","datePublished":"2026-10-07T01:39:15+00:00","mainEntityOfPage":{"@id":"https:\/\/fivemor.com\/?p=7078763"},"wordCount":312,"commentCount":0,"publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"image":{"@id":"https:\/\/fivemor.com\/?p=7078763#primaryimage"},"thumbnailUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/broken-https-tls-1152x648.jpg","keywords":["certificates","Counterfeit","Google","Hackers","Large","Obtain","Services","TLS"],"articleSection":["Biz &amp; IT","Browser","certificate","certificate authority","Security","tls","transport layer security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fivemor.com\/?p=7078763#respond"]}]},{"@type":"WebPage","@id":"https:\/\/fivemor.com\/?p=7078763","url":"https:\/\/fivemor.com\/?p=7078763","name":"Hackers obtain counterfeit TLS certificates for Google and other large services - Som2ny Network","isPartOf":{"@id":"https:\/\/fivemor.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/fivemor.com\/?p=7078763#primaryimage"},"image":{"@id":"https:\/\/fivemor.com\/?p=7078763#primaryimage"},"thumbnailUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/broken-https-tls-1152x648.jpg","datePublished":"2026-10-07T01:39:15+00:00","breadcrumb":{"@id":"https:\/\/fivemor.com\/?p=7078763#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fivemor.com\/?p=7078763"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/?p=7078763#primaryimage","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/broken-https-tls-1152x648.jpg","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/10\/broken-https-tls-1152x648.jpg","width":1152,"height":648},{"@type":"BreadcrumbList","@id":"https:\/\/fivemor.com\/?p=7078763#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/fivemor.com\/?bp_activities=1"},{"@type":"ListItem","position":2,"name":"Hackers obtain counterfeit TLS certificates for Google and other large services"}]},{"@type":"WebSite","@id":"https:\/\/fivemor.com\/#website","url":"https:\/\/fivemor.com\/","name":"Som2ny Network","description":"Daily Deals","publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fivemor.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/fivemor.com\/#organization","name":"Som2ny Network","url":"https:\/\/fivemor.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","width":300,"height":86,"caption":"Som2ny Network"},"image":{"@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","caption":"admin"},"sameAs":["https:\/\/fivemor.com"],"url":"https:\/\/fivemor.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/7078763","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7078763"}],"version-history":[{"count":0,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/7078763\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/media\/7078764"}],"wp:attachment":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7078763"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7078763"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7078763"},{"taxonomy":"dealstore","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fdealstore&post=7078763"},{"taxonomy":"offerexpiration","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fofferexpiration&post=7078763"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}