How the Tumblr worm spread so quickly

Last updated 12:52 04/12/2012
Tumblr Worm
iStock

TO THE CORE: The Tumblr worm took advantage of Tumblr's reblogging feature.

Relevant offers

Digital Living

Google wants to know when users, tempted by an online advert, go to the shops Leaked: hundreds of internal Facebook documents on sex, violence, and terrorism Businessman's ransom nightmare at the hands of cyber hackers Instagram is the worst social network for young people's mental health Google's focus on AI means it will get even deeper into our lives Computer course helping 'digitally disadvantaged' saves ailing mother's family Online retail giants force NZ businesses to implement digital strategies Cyberattack hits at least 200,000 victims in 150 countries British researcher Marcus Hutchins finds kill switch, 'accidentally' stops malware crippling computers worldwide New Zealand upping digital security after 'massive' worldwide cyberattack

This post was originally published on Mashable.

An infectious worm spread rapidly across the blogging platform Tumblr on Monday, causing the site to disable posting and encourage users to reset passwords immediately.

As Tumblr cleans up the mess, web security firm SophosLabs took a deeper look into how the infection spread so quickly. The culprit? Its reblogging feature.

"It appears that the worm took advantage of Tumblr's reblogging feature, meaning that anyone who was logged into Tumblr would automatically reblog the infectious post if they visited one of the offending pages," Sophos said in a blog post.

The pages of about 8000 Tumblr blogs - which were reportedly affected by GNAA, a well-known hacker and internet trolling group - have a form of malicious code embedded within them. 

According to Sophos, the worm was actually hidden inside an iframe, which is a window where content from another site can load (for example, a Facebook button). It was encoded using Base64, so to the naked eye, the malware looked like jumbled text.

Sophos believes the cyber attackers wouldn't have been able to post the worm through JavaScript. Instead, it got around Tumblr's site security by disguising their code through Base 64. Users who came across the worm saw a pop-up message, disguised as a Tumblr prompt.

"If you were not logged into Tumblr when your browser visited the URL, it would simply redirect you to the standard login page," Sophos said. "However, if your computer was logged into Tumblr, it would result in the GNAA content being reblogged on your own Tumblr."

Mashable is the largest independent news source covering digital culture, social media and technology.

Ad Feedback

Comments

Special offers

Featured Promotions

Sponsored Content