The MEGA.nz Chrome Browser Extension Has Been Backdoored (UPDATE)
The MEGA.nz Chrome Extension has been identified as backdoored in the newest version. It is stealing credentials for several services like GitHub and Google, which will be sent to an external website.
Starting with a Reddit thread - just about two hours ago at the moment of writing this - on the /r/Monero subreddit, the MEGA.nz Chrome Browser Extension has been identified as backdoored in the newest version 3.39.4. It is stealing credentials for several services like GitHub and Google, which will be sent to an external website. Note: This story will be updated to keep you up to date.
Reddit user gattacus updated the MEGA.nz extension in his browser, when the extension asked for additional permissions, which made him analyzing the changes in the source code. What he found was a backdoor trying to steal users Monero. The fact that there was no recent commit on the public Git repository on GitHub could mean that MEGAs account on the Google Webstore for Chrome has been hacked or an authorized user (i.e. an insider) pushed the backdoored version to the store.
Shortly after, other researchers like SerHack started investigating this incident, which revealed several other services being affected by this backdoor.
Currently known credentials being snatched:
The extension is not only going for login data, but for wallet private keys.
If you are using the Firefox extension, you are currently not affected by this, as you are still on version 3.39.3.
The Attack Server
d probably contains an internal ID, where 3 stands for GitHub and so on. The
p1 parameter contains the username and
p2 holds the login password.
This incident serves to highlight the risk that third party plugins pose to a robust security posture. It is not yet known if MEGA have been compromised, or if rogue internal elements are behind this backdoor. A lesson everyone can learn from this is thinking twice about the permissions we grant an extension or anything related. They often ask for way more than they actually need. Also - even though it remains unclear how the attacker backdoored the release - employees should be trained for company login best practices and shown how to identify phishing.
At the time of writing this, this is everything that has been revealed. There has been no public statement from Mega yet. Shoutout for the great work by the researchers involved, which were also mentioned above.
UPDATE 04.09.2018 19:32 GMT
The browser extension has been removed from the Google Webstore.
Update 05.09.2018 15:55 GMT
MEGA released a statement on their blog. They confirmed the information released by researchers and are actively investigating the compromise of their Google Webstore account. Additionally, they gave an insight into why the attacker was able to push code as an release on the store. Google started to disallow publisher signatures, which was an important countermeasure to make sure the code is in fact coming from an authorized party.