Tumblr hacked?

> This was just another part of our "anti-blogging" campaign. GNAA's stance on blogging in general has always been a negative one: in short, blogging is lowering journalistic standards to the point where the number of friends a murderer has on Facebook has become news.

http://www.guardian.co.uk/technology/2012/dec/03/tumblr-cybe...

Re: Tumblr hacked?

#5

Post by j2labs » Mon, Dec 03, 2012, 4:35 PM UTC

Nothing particularly interesting seems to have actually happened. Some posts got onto the Dashboard, which was still running. In fact, everything was still working just fine.

Script kiddies found a small crack and went for it.

Re: Tumblr hacked?

#6

Post by shortformblog » Mon, Dec 03, 2012, 4:41 PM UTC

j2labs wrote: post #5

Nothing particularly interesting seems to have actually happened. Some posts got onto the Dashboard, which was still running. In fact, everything was still working just fine. Script kiddies found a small crack and went for it.

My entire dashboard was filled with these worm posts an hour ago, and hit a number of major sites.

Re: Tumblr hacked?

#7

Post by schill » Mon, Dec 03, 2012, 4:50 PM UTC

Looks like a Base64-encoded JS URI in the video player URL. Somewhat sneaky. How it ends up redirecting the page to a reblog URL isn't clear. https://gist.github.com/4196142

Re: Tumblr hacked?

#8

Post by derpenxyne » Mon, Dec 03, 2012, 5:04 PM UTC

The exploit uses a "data-uri script tag" in the video embed field. In other words, it runs some sort of script through the section of the site that's supposed to only allow video embed codes from sites like YouTube and Vimeo. A pretty serious security hole.

Re: Tumblr hacked?

#9

Post by biot » Mon, Dec 03, 2012, 5:22 PM UTC

If you suspect a site has been compromised, wouldn't a better approach be to submit this as a text article explaining your reasons rather than linking to the affected site? Depending on the nature of the hack, the title could easily have been:

  Was Tumblr hacked in order to do drive-by malware installs? (tumblr.com)

Now everyone who clicks is potentially at risk.

Re: Tumblr hacked?

#10

Post by 47eo » Mon, Dec 03, 2012, 5:33 PM UTC

biot wrote: post #9

If you suspect a site has been compromised, wouldn't a better approach be to submit this as a text article explaining your reasons rather than linking to the affected site? Depending on the nature of the hack, the title could easily have been: Was Tumblr hacked in order to do drive-by malware installs? (tumblr.com) Now everyone who clicks is potentially at risk.

Indeed, it was kind of stupid from the submitter.