New York Times, Twitter hacked by Syrian Electronic Army

Media companies including the New York Times, Twitter and the Huffington Post lost control of some of their websites Tuesday after hackers supporting the Syrian government breached the Australian Internet company that manages many major site addresses.

The Syrian Electronic Army, a hacker group that has previously attacked media organizations that it considers hostile to the regime of Syrian president Bashar al-Assad, claimed credit for the Twitter and Huffington Post hacks in a series of Twitter messages.

Security experts said electronic records showed that NYTimes.com, the only site with an hours-long outage, redirected visitors to a server controlled by the Syrian group before it went dark.

New York Times Co NYT.N spokeswoman Eileen Murphy tweeted the "issue is most likely the result of a malicious external attack", based on an initial assessment.

The Huffington Post attack was limited to the blogging platform's U.K. web address. Twitter said the hack led to availability issues for an hour and a half but that no user information was compromised.

The attacks came as the Obama administration considers taking action against the Syrian government, which has been locked for more than two years in an increasingly bloody struggle against rebels.

In August, hackers promoting the Syrian Electronic Army simultaneously targeted websites belonging to CNN, Time and the Washington Post by breaching a third party service used by those sites.

The Syrian Electronic Army, or SEA, managed to gain control of the sites by penetrating MelbourneIT, an Australian Internet service provider that sells and manages domain names including Twitter.com and NYTimes.

Officials at The New York Times, which identified MelbourneIT as its domain name registrar and the primary hacking victim, warned its employees to stop sending sensitive e-mails from their corporate accounts.

MebourneIT spokesman Tony Smith said that login credentials from one of its resellers had been used improperly.

Once MelbourneIT was notified, he said, the company restored the correct domain name settings, changed the password on the compromised account, and locked the records to prevent further alterations.

"We are currently reviewing our logs to see if we can obtain information on the identity of the party that has used the reseller credentials, and we will share this information with the reseller and any relevant law enforcement bodies," Smith said. "We will also review additional layers of security that we can add to our reseller accounts."

Twitter did not respond to requests for comment. In a blog post, the company said "it appears DNS (domain name system) records for various organizations were modified, including one of Twitter's domains used for image serving, Twimg.com. Viewing of images and photos was sporadically impacted."

Hackers limited targets, say experts
Jaeson Schultz, a Cisco Systems researcher, said that in the authoritative records known as WHOIS the Syrian Electronic Army listed itself as the contact for all of Twitter.com, which would have given it the power to take the site offline or place its own content there.

"It seems that their message is redirecting people back to their own website for news about the SEA or about Syria," Schultz said. "They don't seem to be interested in infecting end users, which is a good thing."

Hackers who successfully break into MelbourneIT's systems could potentially redirect and intercept emails sent to addresses under certain domains, researchers said. And users of sites that don't begin with "https" could have been fooled into entering passwords that could have been captured, said Jaime Balsco, a researcher with security firm AlienVault.

Because MelbourneIT serves as the registrar for some of the best known domain names on the Internet, including Microsoft.com and Yahoo.com, Tuesday's breach could have had potentially catastrophic consequences.

"This could've been one of the biggest attacks we've ever seen, if they were more subtle and more efficient about it," said HD Moore, the chief research officer at Rapid7, a cyber security firm. "They changed just a few sites, but if they had actually gone all out, they could've had most of the Internet watching them run the show."

Media companies, which were largely ignored by hackers until 2011, have been targeted since then by pranksters and suspected Chinese agents, as well as partisans in the Middle East.

"As long as media organizations play a critical role as influencers and critics, they will continue to be targets of cyber attacks," said Michael Fey, chief technology officer at Intel Corp's McAfee security division.

© Thomson Reuters 2013