By Robert Mackey

December 18, 2009

Source: The New York Times/The Lede

Updated | 11:19 a.m. As the blogger on TechCrunch, Twitter was apparently attacked on Thursday night by a group identifying itself as the “Iranian Cyber Army.” A leading Iranian opposition Web site was also attacked, apparently by the same group.

The hackers redirected Twitter users to a Web page with the following message:

Iranian Cyber Army

THIS SITE HAS BEEN HACKED BY IRANIAN CYBER ARMY

U.S.A. Think They Controlling And Managing Internet By Their Access, But THey Don’t, We Control And Manage Internet By Our Power, So Do Not Try To Stimulation Iranian Peoples To….

NOW WHICH COUNTRY IN EMBARGO LIST? IRAN? USA?
WE PUSH THEM IN EMBARGO LIST
Take Care.

After the attack was fended off late on Thursday in San Francisco, Biz Stone, one of Twitter’s founders, :

Twitter’s DNS records were temporarily compromised tonight but have now been fixed. As some noticed, Twitter.com was redirected for a while but API and platform applications were working. We will update with more information and details once we’ve investigated more fully.

Twitter has been an important tool for the opposition movement in Iran this year. Following the disputed presidential election there in June, as the country’s government sought to contain mass protests on the streets and online, threatening messages started to appear on the site from at least who claimed to be part of a cyber-unit of the country’s Revolutionary Guards Corps, established to fight enemies of the government.

On both Twitter and the opposition Web site , the message announcing the attack was accompanied by an image of a green flag. Green has been used in Iran recently as the color of the opposition movement, but it is also a color traditionally associated with Islam.

My colleague Nazila Fathi explains that the writing on the image which is not in English includes a line of Arabic script and the words “Ya Hussein” on the green flag, which is a reference to the prophet Muhammad’s grandson, who is revered in Iran. Further down the screen, there is a poem that says, roughly: ‘We will die if our leader orders us to fight, and if he wants, we will be patient and tolerant.’

On TechCrunch Mr. Arrington also reported that a Google search for Twitter briefly returned a result that said, in place of the site’s name: “This Web Site Has Been Hacked By Iranian Cyber Army.” That message is still appearing on Google for searchers looking for Mowjcamp.

According to one of Mr. Arrington’s sources, while the Google result for Twitter was showing the hacked message in English, it was accompanied by a sub-heading in Persian which said, roughly, “In the name of God, as an Iranian this is a reaction to Twitter’s sly interference which was U.S. authorities ordered in the internal affairs of my country.”

At the height of the post-election demonstrations against Iran’s government in the summer, the State Department asked Twitter to postpone a scheduled interruption of the service for maintenance, after opposition supporters expressed fear that the disruption would interfere with their protests.

In Iran on Friday, as , supporters of the government attended public rallies the opposition decided to boycott. According to the news agency, pro-government crowds chanted slogans against the leader of country’s opposition, Mir Hussein Moussavi, including, “Death to Moussavi” and “Moussavi should be executed.”

Regarding the Web attack on Twitter, Daniel Ionescu wrote on the PC World Web site:

The reasoning behind the attack is not known as of yet. The group was previously unknown, and some speculate this attack was carried out by pranksters, rather than pro-Iranian campaigners. Graham Cluley, from the Sophos security firm, that the message posted “does not necessarily mean that hackers from Iran are responsible for the defacement.”

For the non-experts among us, Mr. Cluley explains on his blog:

DNS records work like a telephone book, converting human-readable website names like twitter.com into a sequence of numbers understandable by the internet. What seems to have happened is that someone changed the lookup, so when you entered twitter.com into your browser you were instead taken to a website that wasn’t under Twitter’s control.

At time of writing on Friday morning, Twitter seems to be functioning normally, but the opposition site Mowjcamp remains blocked.

As my colleague on our technology blog “Bits” this morning:

Not long ago, service outages and interruptions on Twitter were frequent enough that the cutesy graphic of a whale being carried by a flock of birds that appeared when the site was down earned the nickname “Fail Whale” by users.

But in recent months the site has done much better.

The last major outage occurred in August, when a two-pronged wave of attacks crippled the service, leaving it completely inaccessible by users for an entire day.