A commercially available tool is out there for attackers to automatically register Tumblr accounts, researchers said.
The tool supports proxies and it can integrate a major CAPTCHA-solving service, said Webroot’s Dancho Danchev. The standard features only include mechanisms to follow and unfollow users, but the premium features can create accounts and upload avatars.
RELATED STORIES
Two Trojans Collaborate in Attack
Filling the Blackhole Void
Exploit Kit Replacement
Police Bust Blackhole Creator Suspect
Attackers could use Tumblr accounts in various ways. They can either sell them to others, or they can use them for their own malicious campaigns. Tumblr is a microblogging platform and social networking website founded by David Karp owned by Yahoo! The service allows users to post multimedia and other content to a short-form blog.
A phishing campaign detailed by ISC uses Tumblr pages to redirect victims to a fake Facebook login page, and ultimately to a malware-serving website.
“Next to its multi-threaded nature, the tool basically possesses every feature an automatic account registration tool has these days,” Danchev said on his blog. “Features like support for proxies and built-in API based support for one of the major CAPTCHA-solving as a service type of cybercrime-friendly propositions, are poised to ensure the success of any campaign aiming to abuse Tumblr for automatic account registration purposes. How would cybercriminals potentially abuse this access? They will either start monetizing the inventory of automatically registered accounts to those who’d abuse it in a purely malicious way, or launch a campaign on their own, while monetizing the traffic through an affiliate network.”
For additional technical details, go to Webroot’s blog.