How the Tumblr worm spread so quickly

Last updated 12:52 04/12/2012
Tumblr Worm
iStock

TO THE CORE: The Tumblr worm took advantage of Tumblr's reblogging feature.

Relevant offers

Digital Living

Google search chief Singhal to retire, replaced by John Giannandrea His internet was slow so he set up a robot to pester company Student in trouble for renting out dorm room on Airbnb SwiftKey keyboard makers become millionaires The rise of coding boot camps Sky Go fault interrupts viewing of Black Caps ODI Concerns grow over app after a 13-year-old's online fantasies turn fatal Telco call centres leaving customers waiting - Consumer NZ survey Weta Workshop partners with Google-backed Magic Leap Netflix scores an own goal

This post was originally published on Mashable.

An infectious worm spread rapidly across the blogging platform Tumblr on Monday, causing the site to disable posting and encourage users to reset passwords immediately.

As Tumblr cleans up the mess, web security firm SophosLabs took a deeper look into how the infection spread so quickly. The culprit? Its reblogging feature.

"It appears that the worm took advantage of Tumblr's reblogging feature, meaning that anyone who was logged into Tumblr would automatically reblog the infectious post if they visited one of the offending pages," Sophos said in a blog post.

The pages of about 8000 Tumblr blogs - which were reportedly affected by GNAA, a well-known hacker and internet trolling group - have a form of malicious code embedded within them. 

According to Sophos, the worm was actually hidden inside an iframe, which is a window where content from another site can load (for example, a Facebook button). It was encoded using Base64, so to the naked eye, the malware looked like jumbled text.

Sophos believes the cyber attackers wouldn't have been able to post the worm through JavaScript. Instead, it got around Tumblr's site security by disguising their code through Base 64. Users who came across the worm saw a pop-up message, disguised as a Tumblr prompt.

"If you were not logged into Tumblr when your browser visited the URL, it would simply redirect you to the standard login page," Sophos said. "However, if your computer was logged into Tumblr, it would result in the GNAA content being reblogged on your own Tumblr."

Mashable is the largest independent news source covering digital culture, social media and technology.

Ad Feedback

Comments

Special offers

Featured Promotions

Sponsored Content