<http://schema.org/articleBody>
"The Syrian Electronic Army, a mysterious pro-Assad hacker group, struck again Tuesday afternoon, taking control of The New York Times and Twitter Internet domains, among others. \nThe Syrian hackers compromised these high-profile websites by targeting the domain name registrar Melbourne IT, an Australian company that sells website addresses such as Mashable.com. The hackers didn't use sophisticated hacking techniques or malware to carry out their attack, all they needed was their usual weapon of choice: a phishing attack. \nSee also: What Is the Syrian Electronic Army?\n\"A targeted phishing attack was used to gain access to the credentials of users of a Melbourne IT reseller account,\" wrote Bruce Tonkin, Melbourne IT's Chief Technology officer, in an email to Mashable. \"We have obtained a copy of the phishing email and have notified the recipients of the phishing email to update their passwords. We have also temporarily suspended access to affected user accounts until passwords have been changed,\" Tonkin said.\nTonkin declined to show the actual phishing email to Mashable \"to avoid copycat attempts,\" but shared some details on how the email fooled the victim. \nThe phishing email used a spoofed address that appeared to be from a trusted source, and its subject \"implied that the email contained some useful information,\" according to Tonkin. \nOnce the victim clicked on the malicious link, Tonkind said, \"they were asked to supply their username and password.\"\nWith the victim's login credentials, the hackers were able to access the company's servers and change the records of The New York Times, Twitter and Twitter's imaging service Twimg.com, as well as the Huffigton Post UK \u2014 all websites registered with Melbourne IT. \nThe hackers changed the sites DNS records \u2014 which is what translates a readable domain name (like Mashable.com) into an IP address, allowing a visitor to view a website. \nMelbourne IT, after spotting the origin of the attack, took some measures to stop it. The company changed the DNS records back to their original values, locked the records to prevent any further changes, and changed the resellers credentials, according to a statement by Melbourne IT's spokesperson Tony Smith.  \nIt's still unclear which particular reseller was compromised and what the particular phishing email contained. But one thing is clear, this wasn't a very technically sophisticated attack, but its results were damaging, and as reported by Forbes, they could've been much worse.\n\"If there is any consolation to be had, it is that this is an incredibly unsophisticated form of attack,\" said Kevin O\u2019Brien, enterprise solutions architect at security firm CloudLock, in an email to Mashable.\nAnd yet, as security researcher Jaime Blasco pointed out in a blog post, a large list of domains \u2014 not only those of the New York Times and Twitter \u2014 were compromised at a certain point, before Melbourne IT took measures to stop the attack. \nThis latest attack shows once again that the SEA has learned that to hit big targets like The New York Times they don't need to go after them directly, but they can just hit third parties that provide some service to the site they want to take down, just like they did in mid August when they compromised Outbrain, in an attack that indirectly affected The Washington Post.\nImage: Ramin Talaie/Getty Images"^^<http://www.w3.org/2001/XMLSchema#string>
<http://mashable.com/2013/08/28/syrian-electronic-army-nyt-twitter-melbourne/>