![](\"https:\/\/varutra-1a3b6.kxcdn.com\/wp-content\/uploads\/2018\/09\/mega-blog-1024x582.png\" "\\"mega")
<\/p>\n<\/p>\n
MEGA is a cloud storage and file hosting service offered by Mega Limited, a New Zealand-based company. The service is offered primarily through web-based apps. Mega mobile apps are also available for Windows Phone, Android and iOS.<\/p>\n
Mega is known for its security feature where all files are end-to-end encrypted locally before they are uploaded. This prevents anyone from accessing the files without knowledge of the pass key used for encryption. As of January 20, 2018, Mega has 100 million registered users in more than 245 countries and territories, and more than 40 billion files have been uploaded to the service.<\/p>\n
<\/p>\n MEGA Chrome Extension 3.39.4<\/p>\n The Firefox version of MEGA has not been impacted or tampered with, and users accessing MEGA through its official website (https:\/\/mega.nz) without the Chrome extension are also not affected by the breach.<\/p>\n All extracted information will be immediately reported to a hacker-controlled server located in Ukraine. A list of the target services includes the following:<\/p>\n Fig: MEGA extension window in browser<\/em><\/p>\n <\/p>\n On 4 September at 14:30 UTC, an unknown attacker managed to hack into MEGA’s Google Chrome web store account and uploaded a malicious version 3.39.4 to the web store. When installed the extension will monitor for specific login form submissions to Amazon, Microsoft, GitHub, and Google.<\/p>\n The hijacked MEGA extension then sent all the stolen information back to an attacker’s server located in Ukraine, which is then used by the attackers to log in to the victims accounts, and also extract the crypto currency private keys to steal user digital currencies.<\/p>\n Although the company has not revealed the number of users affected by the security incident, it is believed that the malicious version of the MEGA Chrome extension may have been installed by tens of millions of users. Fig: Blog post published by the company<\/em><\/p>\n <\/p>\n It would perform monitoring of any form submission where the URL contains the strings Register or Login or variables exist that are named “username”, “email”, “user”, “login”, “usr”, “pass”, “passwd”, or “password”. If the extension detected any of these form submissions or data variables, it would send the credentials and variables values to a host in Ukraine called https:\/\/www.megaopac.host\/.<\/p>\n To make matters worse this extension will also monitor for the following URL patterns: “https:\/\/www.myetherwallet.com\/*”, “https:\/\/mymonero.com\/*”, “https:\/\/idex.market\/*”, and if detected, would execute Javascript that would attempt to steal the crypto currency private keys for the logged in user from these sites.<\/p>\n Fig: Monitoring login attempts to various sites<\/em><\/p>\n Fig: Stealing variables with certain names<\/em><\/p>\n Fig: Sending information to attackers<\/em><\/p>\n Fig: Capturing crypto currency keys<\/em><\/p>\n <\/p>\n The main reason for this attack was Google\u2019s decision to disallow publisher signatures on Chrome extensions and relying solely on signing them automatically after upload to the Chrome web store, which removes an important barrier to external compromise. As a prevention attempt Google removed the MEGA extension from its Chrome Web Store five hours after the breach.<\/p>\n However, after four hours of the security breach MEGA updated the extension with a clean MEGA version (3.39.5), auto-updating all the affected installations.<\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n Author,<\/p>\n What is MEGA? MEGA is a cloud storage and file hosting service offered by Mega Limited, a New Zealand-based company. The service is offered primarily…<\/p>\n","protected":false},"author":3,"featured_media":3383,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[270,277,266,273,274],"tags":[131,132,133,134,136,137,138,127],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t![\"MEGA](\"https:\/\/www.varutra.com\/wp-content\/uploads\/2018\/09\/yyyyyyyyyy.png\")
<\/a><\/p>\nAffected Version<\/strong><\/h3>\n
\n
<\/a><\/p>\nCurrent Scenario<\/strong><\/h3>\n
<\/a><\/p>\nHow this attack works?<\/strong><\/h3>\n
<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\nPrevention attempts by officials<\/strong><\/h3>\n
<\/a><\/p>\nRecommendations<\/strong><\/h3>\n
\n
Some best practices to stay safe in future<\/strong><\/h3>\n
\n
References<\/strong><\/h3>\n
\n
Jinto T.K.<\/strong><\/div>\nSOC Team<\/div>\nVarutra Consulting Pvt. Ltd<\/em><\/div>","protected":false},"excerpt":{"rendered":"