{"id":183672,"date":"2026-10-07T22:54:13","date_gmt":"2026-10-07T20:54:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/komprometacziya-registratorov-3-domennyh-zon-pozvolila-poluchit-tls-sertifikaty-k-servisam-google"},"modified":"2026-10-07T22:54:20","modified_gmt":"2026-10-07T20:54:20","slug":"compromise-of-registrars-for-three-domain-zones-enabled-tls-certificate-issuance-for-google-services","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/compromise-of-registrars-for-three-domain-zones-enabled-tls-certificate-issuance-for-google-services","title":{"rendered":"Kompromiss av registratorer f\u00f6r tre dom\u00e4ner m\u00f6jliggjorde \u00e5tkomst till TLS-certifikat f\u00f6r Googles tj\u00e4nster","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Google meddelade om en incident d\u00e4r angripare lyckades f\u00e5 TLS-certifikat f\u00f6r specifika Google-dom\u00e4ner (t.ex. google.as), online-tj\u00e4nster och stora f\u00f6retag i zonerna «.gh», «.sl» och «.as». Attacken genomf\u00f6rdes genom kompromettering av registratorer f\u00f6r nationella toppdom\u00e4ner — «.gh» (Ghana), «.sl» (Sierra Leone) och «.as» (Amerikanska Samoa), vilket gjorde det m\u00f6jligt att byta ut DNS-servrar f\u00f6r dom\u00e4ner i dessa zoner och omdirigera f\u00f6rfr\u00e5gningar till angriparnas servrar. Genom att omdirigera trafiken kunde angriparna bekr\u00e4fta \u00e4gandet av dom\u00e4nerna och erh\u00e5lla TLS-certifikat, eftersom efter en \u00e4ndring av DNS-data skickades verifieringsf\u00f6rfr\u00e5gningar fr\u00e5n certifikatleverant\u00f6rerna inte till de verkliga utan till manipulerade v\u00e4rdar och hanterades d\u00e4r. <\/p>\n

Obeh\u00f6rig erh\u00e5llning av certifikat uppt\u00e4cktes genom analys av loggar fr\u00e5n Certificate Transparency, d\u00e4r certifikatutf\u00e4rdare reflekterar alla utf\u00e4rdade och \u00e5terkallade certifikat. Google blockerade de illegitima certifikat som erh\u00f6lls under attacken med hj\u00e4lp av CRLSets-mekanismen i webbl\u00e4saren Chrome och kr\u00e4vde \u00e4ven att dessa certifikat skulle \u00e5terkallas av certifikatutf\u00e4rdarna. Det avsl\u00f6jas \u00e4nnu inte f\u00f6r vilka specifika dom\u00e4ner<\/a> falska certifikat utf\u00e4rdades och vilka f\u00f6retag som drabbades av attacken. <\/p>\n

F\u00f6r att minimera riskerna vid upprepning av liknande incidenter rekommenderas dom\u00e4n\u00e4gare att organisera en kontinuerlig \u00f6vervakning av offentliga CT-loggar (Certificate Transparency) f\u00f6r att uppt\u00e4cka obeh\u00f6rig utf\u00e4rdande av certifikat. I DNS rekommenderas att l\u00e4gga till CAA-poster (Certification Authority Authorization) som definierar en lista \u00f6ver certifikatutf\u00e4rdare som har r\u00e4tt att utf\u00e4rda certifikat f\u00f6r den angivna dom\u00e4nen. Att st\u00e4lla in en DNS-post f\u00f6r CAA skyddar inte mot beg\u00e4ran om certifikat efter en DNS-f\u00f6r\u00e4ndring, men efter att kontroll \u00f6ver DNS har \u00e5terst\u00e4llts f\u00f6rhindrar det att angriparna utf\u00e4rdar certifikat igen med hj\u00e4lp av cachad data f\u00f6r dom\u00e4nens \u00e4gande.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0434\u043b\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Google (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, google.as), \u043e\u043d\u043b\u0430\u0439\u043d-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0432 \u0437\u043e\u043d\u0430\u0445 «.gh», «.sl» \u0438 «.as». \u0410\u0442\u0430\u043a\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0437\u043e\u043d \u0432\u0435\u0440\u0445\u043d\u0435\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f — «.gh» (\u0413\u0430\u043d\u0430), «.sl» (\u0421\u044c\u0435\u0440\u0440\u0430-\u041b\u0435\u043e\u043d\u0435) \u0438 «.as» (\u0410\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u043e\u0435 \u0421\u0430\u043c\u043e\u0430), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u043e\u0432 \u0432 \u044d\u0442\u0438\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183672","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kompromiss av registratorer f\u00f6r 3 dom\u00e4nzoner gjorde det m\u00f6jligt att f\u00e5 TLS-certifikat f\u00f6r Googles tj\u00e4nster | ProHoster","description":"Google har meddelat om en incident d\u00e4r angripare lyckades f\u00e5 TLS-certifikat f\u00f6r specifika Google-dom\u00e4ner (till exempel google.as), online-tj\u00e4nster och stora f\u00f6retag inom zonerna \".gh\", \".sl\" och.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/compromise-of-registrars-for-three-domain-zones-enabled-tls-certificate-issuance-for-google-services","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 3 \u0434\u043e\u043c\u0435\u043d\u043d\u044b\u0445 \u0437\u043e\u043d \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c Google | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b \u0434\u043b\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Google (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, google.as), \u043e\u043d\u043b\u0430\u0439\u043d-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0432 \u0437\u043e\u043d\u0430\u0445 ".gh", ".sl" \u0438.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/compromise-of-registrars-for-three-domain-zones-enabled-tls-certificate-issuance-for-google-services","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-07T20:54:13+00:00","article:modified_time":"2026-10-07T20:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/183672","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=183672"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/183672\/revisions"}],"predecessor-version":[{"id":183975,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/183672\/revisions\/183975"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=183672"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=183672"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=183672"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}