If you've ever been told "just look for the padlock," you might want to sit down. Attackers have obtained counterfeit TLS certificates for Google and a number of other large internet services after compromising three domain registries, according to reporting from Ars Technica. The certificates are legitimate-looking — signed by genuine certificate authorities — because the attackers gained enough access to pass the domain validation checks that certificate issuance depends on.

TLS certificates are the mechanism your browser uses to confirm that the website you're talking to is actually the one it claims to be. When an attacker holds a valid certificate for google.com, they can impersonate Google's services in a way that most browsers — and most users — will never flag. It's the digital equivalent of forging a government-issued ID well enough to fool the bouncer.

What actually happened here is that the attackers didn't go after the certificate authorities directly. They hit the registries — the organisations that manage domain name records. By manipulating DNS records at the registry level, they could redirect domain validation checks to infrastructure they controlled, convincing certificate authorities to hand over legitimate certificates. Three registries were involved, which suggests either a coordinated multi-target campaign or a single actor with unusually broad access.

The attack is significant because it targets a layer of internet infrastructure that most security tooling simply trusts. Endpoint detection won't catch it. Firewalls won't catch it. Even certificate transparency logs — the public ledgers designed to make certificate issuance auditable — only help if someone is actively watching them and can respond fast enough.

Why it matters now is partly about scale. Counterfeit certificates for large, widely-trusted services could be used to intercept encrypted traffic, conduct convincing phishing campaigns, or facilitate man-in-the-middle attacks against corporate VPNs and SaaS platforms. Any organisation that relies on TLS to confirm it's talking to a legitimate service — which is essentially every organisation — is theoretically in scope.

For Australian organisations, the relevance is direct. Australia's major banks, government agencies, and critical infrastructure operators all depend on TLS for secure communications. The ACSC has previously highlighted certificate-based attacks in its threat landscape reporting, and the SOCI Act's requirements around communications infrastructure security are squarely relevant when the underlying trust model of the internet is being manipulated at the registry level.

What to watch: Certificate transparency monitoring is your best early-warning system here. Tools like Facebook's CT monitoring service or Google's Transparency Report can alert you when a new certificate is issued for a domain you own — something every organisation with a meaningful internet presence should have configured. The broader question is whether the compromised registries have been fully remediated, and whether other registries were targeted but haven't yet disclosed it. Given that three were involved, assuming this is the complete picture would be premature.