Images on Twitter, and New York Times website, still not appearing for some after domain name server hack by Syrian Electronic Army on Melbourne IT

Twitter's inline image service remains out of action hours after the site's domain name server (DNS) record was hacked, apparently by the hacker group Syrian Electronic Army (SEA), as part of a cyber-attack against the registrar for sites including the New York Times.

Images and some avatars posted to Twitter's twimg.com domain are not appearing when viewed on the web or in Twitter applications because the domain where the pictures are posted, twimg.com, had its domain name details altered on Tuesday.

The New York Times is also affected by the hack, which was carried out against an Australian registrar, Melbourne IT, which separately confirmed that it had been the cause of the failure.

The SEA acquired the user login and password for a US-based reseller via a "spear phishing" email - closely targeted to the user to fool them into passing the details into a fake site. "The attack has been sent to a variety of staff of our reseller," Theo Hnarakis, Melbourne IT's chief executive told Australian AP. "A few of those staff have responded inadvertently."

Armed with the login and password, the SEA hackers were able to change the details of the NYT and Twitter registration so that they pointed to servers of its choice.

They crowed about their success - ironically, on Twitter, where they have had their account deleted 15 times in the past year or so.

Some local Twitter sites - including its India site at twitter.co.in - appear to be still controlled by the SEA. "How Twitter looks when the twimg.com was down", it tweeted - linking to a picture hosted on the twimg.com domain, which therefore didn't appear.

A posting on the Twitter status blog noted that

At 20:49 UTC, our DNS provider experienced an issue in which it appears DNS records for various organizations were modified, including one of Twitter's domains used for image serving, twimg.com. Viewing of images and photos was sporadically impacted. By 22:29 UTC, the original domain record for twimg.com was restored. No Twitter user information was affected by this incident.

However it could take some time for the correct information to re-propagate to other DNS server. DNS updates are not passed on immediately, and can take a day or more to be passed among the DNS server systems used to direct traffic to websites around the web.

A similar hack was used by Turkish hackers against the Daily Telegraph and The Register websites in September 2011, redirecting traffic to its own site, and in 2010 China's Baidu threatened to sue its US registrar over a similar hack.

Twitter users and some people trying to view the New York Times are still being affected because DNS (domain name server) detail changes are not sent immediately to other computers, which use DNS services to look up the physical address of websites: when they are passed a URL such as "theguardian.com", the systems check the records held on the nearest DNS cache to see which internet address to connect to.

A data security source said that there had been a rise in phishing attacks relating to domain names in the past two weeks, with a number appearing to come from Chinese registrars saying there had been a "domain name dispute" and asking domain owners to re-enter their details.

Hnarakis said that "all passwords have been changed, the right blocks have been established, so we're fairly confident this won't occur again."

But Chester Wisniewski of the security company Sophos cautioned: "You are only as strong as your weakest link, which in this case appears to be an external internet service provider."