{"id":183672,"date":"2026-10-07T22:54:13","date_gmt":"2026-10-07T20:54:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/komprometacziya-registratorov-3-domennyh-zon-pozvolila-poluchit-tls-sertifikaty-k-servisam-google"},"modified":"2026-10-07T22:54:20","modified_gmt":"2026-10-07T20:54:20","slug":"compromise-of-registrars-for-three-domain-zones-enabled-tls-certificate-issuance-for-google-services","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/compromise-of-registrars-for-three-domain-zones-enabled-tls-certificate-issuance-for-google-services","title":{"rendered":"Kompromitacja rejestrator\u00f3w 3 stref domenowych umo\u017cliwi\u0142a uzyskanie certyfikat\u00f3w TLS dla us\u0142ug Google","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Firma Google poinformowa\u0142a o incydencie, w wyniku kt\u00f3rego atakuj\u0105cym uda\u0142o si\u0119 zdoby\u0107 certyfikaty TLS dla poszczeg\u00f3lnych domen Google (np. google.as), us\u0142ug online oraz du\u017cych firm w strefach «.gh», «.sl» i «.as». Atak zosta\u0142 przeprowadzony poprzez kompromitacj\u0119 rejestrator\u00f3w krajowych domen najwy\u017cszego poziomu \u2014 «.gh» (Ghana), «.sl» (Sierra Leone) oraz «.as» (Ameryka\u0144skie Samoa), co umo\u017cliwi\u0142o zamian\u0119 serwer\u00f3w DNS dla domen w tych strefach oraz przekierowanie zapyta\u0144 na serwery przest\u0119pc\u00f3w. Przekierowuj\u0105c ruch, atakuj\u0105cy mogli potwierdzi\u0107 posiadanie domen i zdoby\u0107 certyfikaty TLS, poniewa\u017c po zmianie danych w DNS zapytania weryfikacyjne od centr\u00f3w certyfikacji by\u0142y wysy\u0142ane nie na rzeczywiste, a na podmienione hosty i przetwarzane na nich. <\/p>\n

Nieautoryzowane uzyskanie certyfikat\u00f3w zosta\u0142o wykryte w wyniku analizy dziennik\u00f3w przejrzysto\u015bci certyfikat\u00f3w, w kt\u00f3rych centra certyfikacji odzwierciedlaj\u0105 wszystkie wydane i uniewa\u017cnione certyfikaty. Firma Google zablokowa\u0142a nielegalne certyfikaty uzyskane w trakcie ataku za pomoc\u0105 mechanizmu CRLSets w przegl\u0105darce Chrome i r\u00f3wnie\u017c uzyska\u0142a uniewa\u017cnienie tych certyfikat\u00f3w przez centra certyfikacji. Jak dot\u0105d nie ujawniono, dla jakich dok\u0142adnie domen wydano fa\u0142szywe certyfikaty i jakie firmy ucierpia\u0142y w wyniku ataku. <\/p>\n

Aby zminimalizowa\u0107 ryzyko powt\u00f3rzenia podobnych incydent\u00f3w, w\u0142a\u015bciciele domen powinni zorganizowa\u0107 sta\u0142y monitoring publicznych dziennik\u00f3w CT (Certificate Transparency) w celu wykrycia nieautoryzowanego wydania certyfikat\u00f3w. W DNS zaleca si\u0119 dodanie wpis\u00f3w CAA (Certification Authority Authorization), kt\u00f3re okre\u015blaj\u0105 list\u0119 centr\u00f3w certyfikacji, kt\u00f3rym zezwala si\u0119 na wydawanie certyfikat\u00f3w dla danej domeny. Ustawienie wpisu DNS CAA nie ochroni przed \u017c\u0105daniem certyfikatu po zmianie DNS, ale po odzyskaniu kontroli nad DNS zapobiegnie ponownemu wydaniu certyfikat\u00f3w przez przest\u0119pc\u00f3w, wykorzystuj\u0105cych wcze\u015bniej zbuforowane dane potwierdzaj\u0105ce w\u0142asno\u015b\u0107 domeny.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0434\u043b\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Google (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, google.as), \u043e\u043d\u043b\u0430\u0439\u043d-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0432 \u0437\u043e\u043d\u0430\u0445 «.gh», «.sl» \u0438 «.as». \u0410\u0442\u0430\u043a\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0437\u043e\u043d \u0432\u0435\u0440\u0445\u043d\u0435\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f — «.gh» (\u0413\u0430\u043d\u0430), «.sl» (\u0421\u044c\u0435\u0440\u0440\u0430-\u041b\u0435\u043e\u043d\u0435) \u0438 «.as» (\u0410\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u043e\u0435 \u0421\u0430\u043c\u043e\u0430), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u0432 \u0432 \u044d\u0442\u0438\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183672","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kompromitacja rejestrator\u00f3w 3 stref domenowych pozwoli\u0142a uzyska\u0107 certyfikaty TLS dla us\u0142ug Google | ProHoster","description":"Firma Google poinformowa\u0142a o incydencie, w wyniku kt\u00f3rego napastnicy uzyskali certyfikaty TLS dla niekt\u00f3rych domen Google (na przyk\u0142ad google.as), us\u0142ug online i du\u017cych firm w strefach \".gh\", \".sl\" oraz.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/compromise-of-registrars-for-three-domain-zones-enabled-tls-certificate-issuance-for-google-services","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 3 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0437\u043e\u043d \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c Google | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0434\u043b\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Google (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, google.as), \u043e\u043d\u043b\u0430\u0439\u043d-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0432 \u0437\u043e\u043d\u0430\u0445 ".gh", ".sl" \u0438.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/compromise-of-registrars-for-three-domain-zones-enabled-tls-certificate-issuance-for-google-services","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-07T20:54:13+00:00","article:modified_time":"2026-10-07T20:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/183672","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=183672"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/183672\/revisions"}],"predecessor-version":[{"id":183673,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/183672\/revisions\/183673"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=183672"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=183672"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=183672"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}