So Tuesday afternoon I'm trying to pull up a New York Times piece I wanted to link to and the site just... isn't there. Not a 404, not a "server error" page, just nothing loading, then eventually a weird redirect. My first thought was my own wifi being flaky again (it does that around 3pm every day for reasons I've never figured out). Turned out it wasn't me. The Syrian Electronic Army had gotten into the registrar that manages nytimes.com and repointed the domain's DNS records somewhere else entirely. Twitter's image-serving domain got hit the same way, which is why a bunch of tweets that day had broken image icons instead of photos. Huffington Post UK caught some of it too.
Here's the thing that actually stuck with me, and its not really about Syria or politics or any of that. Its that nobody broke into the New York Times' servers. Nobody cracked a password on some CMS or found a hole in their CDN. They got into MelbourneIT, the company that manages the registration for a pile of huge domains, and just changed where the domain pointed. The Times' actual website, sitting on its actual servers, was completely fine the whole time. It just wasn't reachable, because the internet's phone book had been rewritten to send everyone somewhere else.
That is a genuinely different kind of scary than a normal hack, and it made me go check something I honestly hadn't looked at in years: the account I use to manage techpad's domain.
I want to be upfront, I did not love what I found. My registrar password was something I'm pretty sure I set in 2011 and never touched again, no two-factor anything, and the recovery email on file was an old Yahoo account I basically never check. If someone social-engineered their way into that registrar's support line the way the SEA apparently did (multiple reports point to a phishing email that got a reseller employee to hand over credentials), there was nothing stopping them from doing to me what happened to the Times, just at a much smaller and less newsworthy scale.
So if you run any kind of site with your own domain, here's what I actually did this week, in order:
Lock your domain against transfers. Every registrar has a "transfer lock" or "registrar lock" setting, usually buried three menus deep somewhere in account settings. Turn it on. It won't stop a DNS-record change by itself but it adds friction, and friction is most of what security is anyway.
Put two-factor on the registrar account, not just your email. People obsess over 2FA on Gmail and Twitter and completely forget the one account that controls where their entire domain points. If your registrar supports it, and most of the bigger ones do now, turn it on today, not this weekend.
Stop reusing your registrar password anywhere else. I know, I know. Everyone knows this. I still wasn't doing it for this specific account because I figured "eh, it's just a domain," which is exactly the kind of thinking that gets you owned.
Use a separate email for registrar logins, one that isn't your everyday inbox and isn't easily guessable from your Twitter bio or About page. Doesn't need to be fancy, just needs to not be the account every phishing email in the world is already aimed at.
Know your DNS TTLs. If your records are set to expire and refresh every 24 or 48 hours, a hijack sticks around a lot longer even after you fix it. Shorter TTLs mean faster recovery, at the cost of slightly more DNS lookup traffic, which for a blog like this one is not exactly a real cost.
None of this is exotic advice and none of it would have stopped a truly determined, well-resourced attacker going after a specific reseller employee. But it's also not nothing. Most of us aren't the New York Times and don't need Times-level security, we just need to not be the easiest target in the room. I spent maybe twenty minutes on my own setup Tuesday night and went from "wide open" to "at least mildly annoying to break into," which honestly feels like a reasonable bar for a blog that mostly writes about gadgets and RSS readers nobody uses anymore.
Go check your own registrar settings. I'll wait.