How the Tumblr worm spread so quickly

Last updated 12:52 04/12/2012
Tumblr Worm
iStock

TO THE CORE: The Tumblr worm took advantage of Tumblr's reblogging feature.

Relevant offers

Digital Living

Facebook: Resistance is futile Apple employees to start moving into long-awaited campus in April Samsung's reputation tanks after Note 7 fiasco I'll miss TV screens in planes Google, Bing move to block illegal UK sites Tech superheroes take the stress out of new technology 17 retails trends for 2017: from robots, to virtual reality, to drones Dutch town lighting up footpath to save smartphone users from themselves Bluetooth blues: When all your connected devices fail at once Magic Leap sued for sex discrimination by woman hired to increase diversity

This post was originally published on Mashable.

An infectious worm spread rapidly across the blogging platform Tumblr on Monday, causing the site to disable posting and encourage users to reset passwords immediately.

As Tumblr cleans up the mess, web security firm SophosLabs took a deeper look into how the infection spread so quickly. The culprit? Its reblogging feature.

"It appears that the worm took advantage of Tumblr's reblogging feature, meaning that anyone who was logged into Tumblr would automatically reblog the infectious post if they visited one of the offending pages," Sophos said in a blog post.

The pages of about 8000 Tumblr blogs - which were reportedly affected by GNAA, a well-known hacker and internet trolling group - have a form of malicious code embedded within them. 

According to Sophos, the worm was actually hidden inside an iframe, which is a window where content from another site can load (for example, a Facebook button). It was encoded using Base64, so to the naked eye, the malware looked like jumbled text.

Sophos believes the cyber attackers wouldn't have been able to post the worm through JavaScript. Instead, it got around Tumblr's site security by disguising their code through Base 64. Users who came across the worm saw a pop-up message, disguised as a Tumblr prompt.

"If you were not logged into Tumblr when your browser visited the URL, it would simply redirect you to the standard login page," Sophos said. "However, if your computer was logged into Tumblr, it would result in the GNAA content being reblogged on your own Tumblr."

Mashable is the largest independent news source covering digital culture, social media and technology.

Ad Feedback

Comments

Special offers

Featured Promotions

Sponsored Content