The attack on The New York Times website by a hacker group allied with the Syrian Government has now been broadened. The group has now attacked Melbourne IT itself, and other sites for which the Australian company acts as domain name registrar. Melbourne IT, which began in 1996, was one of the first major registrars worldwide to build a business wholesaling its services to other Internet companies. It has many resellers in the US and around the world.

At the time of writing, Melbourne IT’s blog site (www.melbourneit.com.au/blog) cannot be reached – it redirects to the domain name search page.

The New York Times website, which could not be accessed for nearly 24 hours, is now running again. Its most recent Op-Ed piece is headed ‘Bomb Syria, Even if It Is Illegal’. That’s just the sort of thing that got the SEA so upset in the first place. But the newspaper is not giving much prominence to the hack attack in its news pages, with just a single story published Tuesday. It gives a short background to the SEA:

The SEA first emerged in May 2011, during the first Syrian uprisings, when it started attacking a wide array of media outlets and nonprofits and spamming popular Facebook pages like President Obama’s and Oprah Winfrey’s with pro-Assad comments. Their goal, they said, was to offer a pro-government counternarrative to media coverage of Syria.

The group, which also disrupted The Financial Times in May, has consistently denied ties to the government and has said it does not target Syrian dissidents, but security researchers and Syrian rebels say they are not convinced. They say the group is the outward-facing campaign of a much quieter surveillance campaign focused on Syrian dissidents and are quick to point out that [Syrian leader] Assad once referred to the SEA as ‘a real army in a virtual reality.’

Melbourne IT’s outgoing CEO, Theo Hnarakis, has said that he believes the attack came through ‘spear phishers’ in India. He told The Australian Financial Review that the group used the login credentials of a US reseller. That reseller is very likely to have been Corporation Services Company, which acquired Melbourne IT’s Digital Brand Services division for $152.5 million in March (CommsWire, 14 March 2013).

The attacks take advantage of the Internet’s Domain Name System (DNS). Melbourne IT has advised its users to “take advantage of additional registry lock features available from domain name registries.”

Some security analysts have criticised Melbourne IT for not having more secure systems. It does not currently have a system in place to automatically lock access to its DNS registry, relying instead on its customers to implement such a system.