Root Causes 682: ccTLD DNS hijack exposed by CT logs

In this episode, Jason and Tim discuss the recent compromise of DNS for several country-code top-level domains, including .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa), which made domain control validation untrustworthy for every domain under them. Chrome blocked the unauthorized certificates that were found, thanks to certificate transparency logs, though it could not guarantee it found every affected domain. We explain why CAA records could not help, since CAA lives in the same DNS that the attacker controlled, how this relates to multi-perspective issuance corroboration, and the two takeaways: protect your DNS settings at all costs and watch the CT logs.