Tumblr Accounts Hacked By 'Racist' Javascript Virus – Thousands Affected

4 December 2012, 10:14 am EST By Alexandra Burlacu Mobile&Apps

A malicious worm has hit popular site Tumblr, posting a racist message to users' blogs without their permission.

In response, Tumblr is encouraging users who have seen the post to immediately log out of browsers that might be using the service.

"We are aware that there is a viral post circulating on Tumblr. We are working to resolve the issue as swiftly as possible. Thank you," the company posted on Twitter.

The message posted on users' blogs is the work of a group that goes by the name of Gay Ni**er Association of America (GNAA), an "anti-blogging Internet-trolling organization," as Wikipedia defines it.

"[The] propagation of the most fu**ing worthless, contrived, bourgeoisie, self-congratulating and decadent bulls**t the Internet has ever had the misfortune of facilitating," the fake post described Tumblr. The message further accuses Tumblr users of being unoriginal, among others, and suggests they kill themselves.

"Attempting to delete these posts will delete your tumblr account, [so] by all means, go ahead!" concludes the post.

On Monday, Dec. 3, the GNAA tweeted via the @gary_niger account that its fake message had hit 3,800 unique Tumblr users. According to Gizmodo, that number was later raised to 8,600 affected users. While those tweets seem to have been deleted in the meantime, the @gary_niger handle is currently re-tweeting messages of support, as well as Twitter responses from angry Tumblr users.

The worm in question seems to have taken advantage of Tumblr's re-blogging feature, said Sophos security analyst Graham Cluley. The analyst explained in a blog post that any user who was logged into Tumbler would automatically re-blog the infectious post simply by visiting one of the offending pages.

Some users who were affected by the malware saw a pop-up message warning them that Tumblr would be undergoing maintenance on Dec. 4, starting at 1 a.m. The pop-up gave users two options: "Stay on Page" or "Leave Page."

If a user was not logged into Tumblr, visiting the infectious url would simply redirect them to their standard login page, Cluley further explained. If the computer was logged into Tumblr, however, the GNAA content was re-blogged on their Tumblr.

According to Tumblr, its engineers have managed to resolve the issue and get things back on track. The company further assures its users that no accounts have been compromised, and no action is necessary on their part. 

 

© 2016 Mobile & Apps, All rights reserved. Do not reproduce without permission.

Join Our Conversation

Sign up for our Newsletter

Real Time Analytics