Someone compromised a Google Chrome extension with malicious code designed to snoop on users' account credentials and cryptocurrency private keys. On 4 September, a security researcher who goes by the name "SerHack" tweeted out a warning about version 3.39.4 of the Chrome extension for MEGA.nz, a cloud storage and file sharing service. https://twitter.com/serhack_/status/1037026672787304450 The compromised Chrome extension was capable of monitoring for login form submissions to Amazon, GitHub, Google and Microsoft. As analyzed by Bleeping Computer, it also had the ability to inspect a form submission URL for variables like "username" and "password." Additionally, the extension monitored for three URL patterns--"https://www.myetherwallet.com/*," "https://mymonero.com/*," and "https://idex.market/*"--for the purpose of stealing a user's cryptocurrency private keys. This data tracking culminated in the extension sending out any variables and credentials it found to a host based in Ukraine. Security researchers examined the Firefox version of MEGA.nz and determined that it was clean of malicious behavior. According to a MEGA.nz blog post, the company's admins uploaded a clean version of the Chrome extension (3.39.5) four hours after a bad actor uploaded the compromised version. Just an hour after that fix, Google removed the updated extension from its Chrome store. The MEGA.nz team went on to express regret for the event but not without placing some of the blame on Google for its Chrome extension signing policies:
We would like to apologise for this significant incident. MEGA uses strict release procedures with multi-party code review, robust build workflow and cryptographic signatures where possible. Unfortunately, Google decided to disallow publisher signatures on Chrome extensions and is now relying solely on signing them automatically after upload to the Chrome webstore, which removes an important barrier to external compromise. MEGAsync and our Firefox extension are signed and hosted by us and could therefore not have fallen victim to this attack vector. While our mobile apps are hosted by Apple/Google/Microsoft, they are cryptographically signed by us and therefore immune as well.
Users who either automatically updated to or directly installed version 3.39.4 of the MEGA.nz Chrome extension should remove the program from their web browser and update to the newest version. They should also consider changing the passwords for all of the web accounts they used while version 3.39.4 of the extension was installed. News of this compromise comes a year after phishers hijacked another Chrome extension and abused their ill-gotten access to push out spam to unsuspecting users in the summer of 2017.
