Twitter -- but not the Times -- also subscribed to a registry lock service, which resembles a credit card fraud alert: Whenever someone attempts to do something suspicious, such as change DNS settings, the website owner receives an email alert. Such services cost as little as $50 per year, and are available from VeriSign and NeuStar. While the cost to the Times from the advertising revenue it lost as a result of the disruptions can't be tallied in full until its site is fully restored, the cost is likely to be orders of magnitude more expensive than a registry lock service subscription.
Why don't more registrars offer locking as an always-on service, layered with even better security controls? "The domain name registrars are trying to get better at doing things like this," said Carl Herberger, VP of security solutions for Radware, speaking by phone. "A lot of times there are complications in the way that they can actually accomplish their business. If you change the configuration it may break something."
In addition, using registry locks requires more effort when it comes to renewing domain names. Furthermore, what's to prevent an attacker from hacking into the registry lock provider?
5. Beware Simple Solutions
There is no silver bullet for preventing opportunistic attacks, and every new defense, such as registry locks, might create a potential new weakness, or require more effort. "At the end of the day, this was an integrity-based attack, and what I mean by that is they reconfigured the domain servers so they did different things," said Herberger. "So, to ensure the integrity of those different things, you're [now] going to lock those," referring to registry locking services. But what if someone attacks those services directly, or finds a way to cause long-term outages that leave customers unable to unlock settings?
Herberger added: "Whenever you centralize all of your security around fewer gatekeepers, you have the opportunity of a denial of service. That's the irony of it."
6. Be Prepared To Not Stop Every Attack
If attackers devote enough time and energy to finding a weakness that they can exploit with relatively low cost and little effort, then it will be almost impossible to stop them. "There's not a whole lot The New York Times can do if their third party DNS provider was hacked," said Ken Pickering, director of engineering at penetration testing firm CORE Security, via email. "The system is only really failsafe if DNS providers are unhackable, which obviously isn't the case. And this is the resultant outcome: A story that the NYT was hacked with very little they could do aside from picking a better service provider."
Furthermore, it's important to remember that the SEA -- graduating from its long-running Twitter account takeover activities -- found a new vulnerability to exploit. "They exposed some world-class exposures in some world-class environments," said Herberger. "To take down The New York Times website? Pretty impressive. To expose some security problems in Twitter, even if the rest of the world didn't know they were there? Very impressive."