DailyTech - Troll Group "GNAA" Hacks The Verge, Reuters, and 8,600 Other Tumblr Accounts

Submit News

Internet Troll Group "GNAA" Hacks The Verge, Reuters, and 8,600 Other Tumblr Accounts
Jason Mick (Blog) - December 3, 2012 1:19 PM

9 comment(s) - last by ElConquistador.. on Dec 4 at 11:05 PM

The Verge suggests attack may be related to recent guilty verdict for group member; Tumblr promises investigation

The offensively named cyber-troll/hacker organization "GNAA" has claimed responsibility for a wild campaign of attacks against Tumblr users. Approximately 8,600 Tumblr users were affected, indicating the attackers may have found an underlying flaw in the popular microblogging platform's security process.

Most of the victims of the attack were personal blogs. However, several news sites -- Reuters, The Verge, and others -- had their Tumblr accounts compromised, as well.

Tumblr has confirmed that the GNAA may be exploiting a security flaw, commenting:

There is a viral post circulating on Tumblr which begins "Dearest 'Tumblr' users". If you have viewed this post, please log out of all browsers that may be using Tumblr immediately. Our engineers are working to resolve the issue as swiftly as possible. Thank you.

Affect users had their normal feeds replaced with an offensive image urging users to commit suicide.

The Verge has suggested that the attack may somehow be in retaliation for or connected to the recent guilty verdict for Andrew Auernheimer, aka "weev" or "Escher Auernheimer", a member of GNAA and the related subgroup "Goatse Sec". Mr. Auernheimer was found guilty of two rather ambiguous cyber-crime charges -- spelled out in the Computer Fraud and Abuse Act of 1986 (18 USC § 1030) -- and faces a maximum sentence of five years in prison and a fine of up to $250,000 USD.

Tumblr has responded with the following statement:

Sources: The Verge, Gary Niger on Twitter

Comments

Threshold

Username
Password
remember me

This article is over a month old, voting and posting comments is disabled

RE: Point?

By Solandri on 12/3/2012 3:06:36 PM , Rating: 2

It's using a "feature" Tumblr added where you can automatically "reblog" stuff from someone else's Tumblr page onto your own.
http://www.wikihow.com/Reblog-Something-on-Tumblr

Basically they decided people having to cut and paste a URL was too hard, so they turned it into two clicks (reblog and confirm). So the worm just has to send those two clicks to the server when you view the page to spread itself.

Parent

RE: Point?

By Trisped on 12/3/2012 3:23:46 PM , Rating: 2

I was going to say it is a standard cookie attack, if you are logged in to a blog site it does not take much malicious code to start sending silent requests using the current user's login.

The harder thing in my mind is preventing the user from deleting the malicious post using the built in functions.
Does Tumblr not allow deleting posts?

Parent

"We shipped it on Saturday. Then on Sunday, we rested." -- Steve Jobs on the iPad launch