Incident: Hackers Breach MelbourneIT, Disrupting Major Media Websites

Published Date: 2013-08-27

Postmortem Analysis
Timeline 1. The software failure incident happened in August 2013.
System 1. MelbourneIT's systems [20857] 2. Domain Name System (DNS) records [20857]
Responsible Organization 1. The Syrian Electronic Army (SEA) was responsible for causing the software failure incident by breaching the Australian Internet company that manages major site addresses, leading to the hacking of websites such as the New York Times, Twitter, and the Huffington Post [20857].
Impacted Organization 1. New York Times [20857] 2. Twitter [20857] 3. Huffington Post [20857]
Software Causes 1. The software cause of the failure incident was a malicious external attack by hackers supporting the Syrian government, specifically the Syrian Electronic Army, who breached the Australian Internet company that manages major site addresses, leading to control loss of websites like New York Times, Twitter, and Huffington Post [20857].
Non-software Causes 1. The breach occurred due to hackers supporting the Syrian government breaching the Australian Internet company that manages major site addresses, leading to loss of control of websites for media companies like the New York Times, Twitter, and the Huffington Post [20857]. 2. The hackers gained access to the New York Times domain by tricking staff members from a reseller of MelbourneIT, the Australian Internet service provider, into providing login details through a fake email [20857]. 3. The attack was initiated by the Syrian Electronic Army to create a high-profile event, targeting media organizations considered hostile to the Syrian President Bashar al-Assad [20857].
Impacts 1. The New York Times, Twitter, and the Huffington Post lost control of some of their websites after hackers breached the Australian Internet company managing major site addresses, leading to outages and redirection of visitors to a server controlled by the Syrian Electronic Army [20857]. 2. NYTimes.com experienced an hours-long outage, while the Huffington Post's British web address was affected, causing availability issues for Twitter for 90 minutes [20857]. 3. The hack did not compromise user information on Twitter, but it disrupted services and led to DNS record modifications, impacting image serving on Twimg.com [20857]. 4. The incident raised concerns about potential interception of emails and capturing of passwords for sites not using HTTPS, highlighting the security risks associated with breaches like this [20857]. 5. The attack demonstrated the vulnerability of domain name registrars like MelbourneIT, which could have had catastrophic consequences if the hackers had been more subtle and efficient in their actions [20857].
Preventions 1. Implementing stronger authentication measures, such as multi-factor authentication, to prevent unauthorized access to sensitive accounts and domains [20857]. 2. Conducting regular security training for employees to raise awareness about phishing attacks and social engineering tactics used by hackers [20857]. 3. Enforcing strict email security protocols to prevent staff from falling victim to fake emails seeking login details [20857]. 4. Utilizing secondary security measures like registry locks to add an extra layer of protection against unauthorized domain modifications [20857]. 5. Enhancing network security measures to detect and prevent unauthorized changes to DNS records, such as implementing intrusion detection systems and monitoring tools [20857].
Fixes 1. Enhancing cybersecurity measures to prevent unauthorized access and breaches, such as implementing multi-factor authentication, regular security audits, and employee training on recognizing phishing attempts [20857]. 2. Implementing stricter controls and protocols for domain name registrars to prevent unauthorized changes to DNS records and domain settings [20857]. 3. Utilizing secondary security measures like registry locks to add an extra layer of protection against unauthorized domain modifications [20857]. 4. Improving email security practices, such as avoiding sending sensitive information via email and educating employees on recognizing and avoiding phishing emails [20857].
References 1. New York Times Co spokeswoman Eileen Murphy [20857] 2. CEO Theo Hnarakis of MelbourneIT [20857] 3. Twitter [20857] 4. Security experts [20857] 5. Cisco Systems researcher Jaeson Schultz [20857] 6. Security firm AlienVault researcher Jaime Blasco [20857] 7. HD Moore, chief research officer at Rapid7 [20857]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - The New York Times was one of the organizations affected by the hack, with their website experiencing an hours-long outage due to the redirection of visitors to a server controlled by the Syrian Electronic Army [20857]. - MelbourneIT, the Australian Internet company that manages major site addresses, was identified as the main hacking victim in this incident, with the breach traced back to an Indian Internet service provider [20857]. (b) The software failure incident having happened again at multiple_organization: - Prior to this incident, hackers supporting the Syrian government had targeted websites belonging to CNN, Time, and the Washington Post by breaching a third-party service used by those sites [20857]. - Media companies, including the New York Times, Twitter, and the Huffington Post, have been targeted by hackers in the past, with incidents involving breaches and attacks on their websites [20857].
Phase (Design/Operation) design (a) The software failure incident reported in the articles can be attributed to the design phase. The incident occurred due to hackers breaching an Australian Internet company, MelbourneIT, which manages major site addresses including those of media companies like the New York Times, Twitter, and the Huffington Post. The hackers gained control by penetrating MelbourneIT's systems through a fake email seeking login details, leading to the redirection of visitors to a server controlled by the Syrian Electronic Army [20857]. This breach highlights a vulnerability in the design or security measures of the system during development or operation, allowing unauthorized access and control by external entities.
Boundary (Internal/External) within_system, outside_system (a) The software failure incident reported in the articles is primarily due to contributing factors that originate from within the system. The incident involved hackers supporting the Syrian government breaching an Australian Internet company, MelbourneIT, which manages major site addresses for media companies like the New York Times, Twitter, and the Huffington Post [20857]. The New York Times website experienced an hours-long outage after being redirected to a server controlled by the Syrian Electronic Army (SEA), a hacker group supporting Syrian President Bashar al-Assad [20857]. The SEA managed to gain control of the sites by penetrating MelbourneIT, the domain name registrar for NYTimes.com and other media organizations [20857]. MelbourneIT confirmed that the breach occurred when two staff members from one of their resellers opened a fake email seeking login details, leading to the compromise of the NYTimes domain manager's login and password information [20857]. The incident was described as a sophisticated attack orchestrated by the SEA to create a high-profile event [20857]. (b) The software failure incident also involved contributing factors that originate from outside the system. The hackers supporting the Syrian government targeted the media companies, including the New York Times, Twitter, and the Huffington Post, as part of their cyber attacks against organizations they considered hostile to the Syrian government [20857]. The attack on the New York Times, Twitter, and the Huffington Post websites was attributed to the Syrian Electronic Army (SEA), a hacker group known for targeting media organizations and other entities perceived as adversaries of the Syrian President Bashar al-Assad [20857]. The SEA breached MelbourneIT, an Australian Internet service provider that manages domain names for various major websites, to gain control over the targeted sites [20857].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incident in the news article was primarily caused by hackers supporting the Syrian government breaching the Australian Internet company that manages major site addresses, leading to websites like the New York Times, Twitter, and the Huffington Post losing control [Article 20857]. - The Syrian Electronic Army (SEA), a hacker group, claimed credit for the hacks on Twitter and the Huffington Post, redirecting visitors to a server controlled by the group before the sites went dark [Article 20857]. - The attack on NYTimes.com resulted in an hours-long outage, with the site redirecting visitors to a server controlled by the Syrian group [Article 20857]. - The breach at MelbourneIT, an Australian Internet service provider, allowed the SEA to gain control of sites like Twitter.com and NYTimes.com, leading to the software failure incident [Article 20857]. (b) The software failure incident occurring due to human actions: - The breach at MelbourneIT was tracked back to an Indian Internet service provider, where two staff members from one of their resellers opened a fake email seeking login details, leading to the compromise of the account information [Article 20857]. - One staff member at MelbourneIT had the login and password information of the NYTimes domain in his email, which the hackers accessed, contributing to the software failure incident [Article 20857]. - The CEO of MelbourneIT mentioned that the SEA targeted the company specifically to create a high-profile event, indicating a deliberate human action behind the attack [Article 20857].
Dimension (Hardware/Software) software (a) The software failure incident reported in the articles was not due to hardware issues but rather due to a hack orchestrated by the Syrian Electronic Army (SEA) targeting the Australian Internet company MelbourneIT, which manages major site addresses for media companies like the New York Times, Twitter, and the Huffington Post [20857]. (b) The software failure incident was primarily due to contributing factors originating in software, specifically a malicious external attack by hackers supporting the Syrian government, which led to the loss of control of websites belonging to media companies like the New York Times, Twitter, and the Huffington Post [20857].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in the articles is malicious in nature. The incident involved hackers supporting the Syrian government breaching an Australian Internet company, MelbourneIT, which manages major site addresses including those of media companies like the New York Times, Twitter, and the Huffington Post. The Syrian Electronic Army (SEA), a hacker group hostile to Syrian President Bashar al-Assad, claimed credit for the hacks on Twitter and the Huffington Post. The New York Times website was redirected to a server controlled by the Syrian group before going dark, indicating a deliberate attack [20857]. The hackers targeted specific websites and had the ability to take sites offline or place their own content there, demonstrating a malicious intent [20857]. (b) The software failure incident is not non-malicious. The attack was not accidental or unintentional but rather a deliberate act by the hackers to disrupt the functioning of the targeted websites. The hackers gained control of the sites by penetrating the systems of MelbourneIT, a domain name registrar, and actively sought login details through deceptive means. The incident involved sophisticated tactics and targeted specific organizations, indicating a malicious intent to cause disruption and potentially capture sensitive information [20857].
Intent (Poor/Accidental Decisions) unknown (a) The intent of the software failure incident was not due to poor decisions but rather a deliberate and targeted attack by hackers supporting the Syrian government, specifically the Syrian Electronic Army (SEA). The hackers breached the Australian Internet company MelbourneIT, which manages major site addresses, to gain control of websites belonging to media companies like the New York Times, Twitter, and the Huffington Post [20857]. The attack was described as quite sophisticated, with the hackers specifically targeting high-profile websites to create an event [20857]. (b) The software failure incident was not accidental but rather a deliberate and intentional act by the hackers. The Syrian Electronic Army claimed credit for the hacks on Twitter and the Huffington Post, redirecting visitors to a server controlled by the group. The attack was part of the SEA's ongoing efforts to target media organizations they consider hostile to the Syrian government [20857].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the article as hackers supporting the Syrian government breached the Australian Internet company that manages major site addresses, leading to websites like the New York Times, Twitter, and the Huffington Post losing control [20857]. This breach occurred due to the hackers gaining access to the domain name registrar, MelbourneIT, through a phishing attack on staff members, indicating a lack of professional competence in handling security measures and protecting sensitive information [20857]. (b) The accidental aspect of the software failure incident is highlighted in the article when MelbourneIT tracked the breach to an Indian Internet service provider, where two staff members from one of their resellers inadvertently opened a fake email seeking login details, leading to the compromise of the account [20857]. This accidental action by the staff members allowed the hackers to access the login and password information, ultimately resulting in the software failure incident.
Duration temporary (a) The software failure incident in the articles was temporary. The New York Times website experienced an hours-long outage, Twitter had availability issues for 90 minutes, and the Huffington Post attack was limited to the blogging platform’s British web address [20857]. These incidents indicate that the software failure was not permanent but rather temporary in nature.
Behaviour crash, other (a) crash: The software failure incident in the articles can be categorized as a crash. This is evident from the fact that NYTimes.com experienced an hours-long outage and redirected visitors to a server controlled by the Syrian Electronic Army before going dark [20857]. (b) omission: There is no specific mention of the software failure incident being related to omission in the articles. (c) timing: The incident does not align with a timing failure where the system performs its intended functions but at the wrong time. (d) value: The software failure incident does not involve the system performing its intended functions incorrectly. (e) byzantine: The behavior of the software failure incident does not exhibit the characteristics of a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. (f) other: The behavior of the software failure incident can be categorized as a targeted attack by hackers, specifically the Syrian Electronic Army, aiming to disrupt the services of media companies like the New York Times, Twitter, and the Huffington Post by gaining control over their websites [20857].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident described in the articles resulted in the loss of control of websites belonging to media companies such as the New York Times, Twitter, and the Huffington Post after hackers breached the Australian Internet company that manages major site addresses [20857]. The New York Times website experienced an hours-long outage, redirecting visitors to a server controlled by the Syrian Electronic Army (SEA) before going dark [20857]. Additionally, the SEA managed to gain control of sites by penetrating MelbourneIT, an Australian Internet service provider that sells and manages domain names, including Twitter.com and NYTimes [20857]. This breach led to potential interception of emails and the need for password changes and locking domain name settings to prevent further alterations [20857].
Domain information, government (a) The failed system was intended to support the information industry, specifically media companies like the New York Times, Twitter, and the Huffington Post. These companies lost control of their websites after hackers breached the Australian Internet company that manages major site addresses [Article 20857]. (l) The failed system also had implications for the government industry as the attacks came at a time when the Obama administration was considering military action against the Syrian government. The Syrian Electronic Army targeted websites of media organizations they considered hostile to Syrian President Bashar al-Assad [Article 20857].

Sources

Back to List