sloth unleashed

A quickly spreading worm on Tumblr has caused media companies The Verge, Reuters, and a large number of other account holders to publish a post laced with racist epithets and other offensive content.

The stunt, attributed to long-time Internet trolling collective GNAA, caused affected Tumblr accounts to display the post. People who viewed the post while logged into Tumblr were in turn forced to publish the offensive content, causing the attack to spread virally according to security researchers. More than 86,000 accounts were affected, according to unconfirmed claims from GNAA members. Tumblr issued a statement saying site engineers are working to combat a “viral post circulating on Tumblr.” It advised anyone who has viewed the post to immediately log out of all browsers that may be logged in.

According to researchers at antivirus provider Sophos, the GNAA post spread by including malicious code that exploited weaknesses in Tumblr’s reblogging feature. A coding tag contained in the post linked to malicious code on another website. The JavaScript exploit, which was included in an iframe tag that pointed to an outside website, used what is known as base-64 encoding. It’s a technique that uses printable ASCII characters to represent large chunks of binary data and has the benefit of making it harder to know exactly how a script will behave when executed.

“It shouldn’t have been possible for someone to post such malicious JavaScript into a Tumblr post,” Sophos Senior Technology Consultant Graham Cluley wrote. “Our assumption is that the attackers managed to skirt around Tumblr’s defenses by disguising their code through Base 64 encoding and embedding it in a data URI.”

It’s unclear how the worm was able to spread so rapidly, but one theory that couldn’t be ruled out as of the time of this writing is the possibility of an XSS hole found on Tumblr’s site. Short for cross-site scripting, XSS techniques allow attackers to inject browser code of their choice into websites that are trusted by millions of users. In turn, miscreants can exploit XSS holes to perform drive-by malware installations, steal Web authentication credentials, post unauthorized content, or carry out other tasks not intended or initiated by the end user…