MEGA Warns Against An Infected Chrome Extension That Steals Data

The popular cloud storage service MEGA has warned users of an infected version of its own Chrome extension that was distributed through the official download channel and tried to steal all kinds of user data. According to MEGA, the cloud storage service of internet entrepreneur Kim Dotcom, an attacker has gained access to the official Chrome Web Store account of the company.

Then an infected version of the MEGA Chrome extension was placed in the Web Store and automatically offered to existing users. This version required permission to read data on all websites. As soon as users granted this permission, the extension tried to steal private keys for cryptocurrency wallets and user names and passwords for Amazon, GitHub, Google and Microsoft accounts.

After five hours, the infected Chrome extension was removed from the Chrome Web Store by Google. MEGA states that it has initiated an investigation to find out how the Web Store account could be taken over. The cloud storage service also gets to Google because it does not allow developers to sign their Chrome extensions. The extensions are now automatically signed after being uploaded to the Chrome Web Store. According to MEGA, this will remove an important measure that must protect against attackers.

Before MEGA gave the warning, Jeremy Nation of MetaCert already came up with an analysis of the infected extension. It is not the first time that attackers get access to the Web Store account of an extension developer and then distribute an infected update or version. At the end of last year, eight Chrome extensions were discovered that had been hacked and adware was installed by the 4.6 million users. The attackers had been able to trace the login data for the Web Store through these phishing attacks.

Ransomware-Maker Repents And Gives Decryption Keys Away

Last Monday, numerous computers suddenly by a new ransomware variant called Locker hit a small amount to the victims asked for decryption, but the automaker would now regret his actions and provides all the decryption keys free of charge.

In addition, the ransomware on June 2 will automatically create all encrypted files accessible. Locker really came up out of nowhere. The ransomware had for some time on computers running before it on May 25 suddenly proceeded to encrypt files.At various forums complained large numbers of users that their files were encrypted suddenly. Unlike other ransomware variants, which require hundreds of dollars, Locker asked a sum of 22 euros for decrypting the files.

On Saturday put someone who "Poka Bright Minds" calls a message on Pastebin . In it he claims to be responsible for Locker. According to him it was never intended to spread the ransomware. The online storage Mega he has now a file with bitcoin addresses and keys installed. The forum Bleeping Computer confirms that the file actually contains the keys of victims. In addition, on June 2, the automatic start decryption. How the malware spread exactly is still unknown.

File Information 

Name: database_dump.csv

Size: 127.5 MB

MD5: d4d781412e562b76fe0db0977cf6279b

SHA-1: 6ba671ce2a6c256c74d7db81186b0dbddd5e2185

SHA-256: d7fd791b86615fada64fe0290aecb70e5584b9ac570e7b55534555a3b468b33f

VirusTotal Link

Mega Link

MEGA: PayPal Account Closed Due To Encryption

PayPal has the account of the online storage MEGA closed, according MEGA is due to the end-to-end encryption which it offers to users. That leaves the storage service of internet entrepreneur Kim Dotcom in a blog posting know. MEGA states that it is aware of a report that the storage service as illegal cloud storage service was dismissed.

This US Senator Patrick Leahy Visa and Mastercard put under pressure not to accept payments for more MEGA. Then the credit card companies would have PayPal put under pressure not to process payments more for MEGA. MEGA showed opposite PayPal know that it is indeed a legitimate service and provided all kinds of statistics to prove this. Yet PayPal decided to discontinue the service towards MEGA.

MEGA would have made the payment service excuses and admitted that it was a legitimate service. One of the biggest stumbling blocks, however, the end-to-end encryption it offers, which is unknown what is offered via the cloud storage service. MEGA still pointed to the encryption models of other cloud storage services such as Apple, Dropbox and SpiderOak, but that would be no problem for the pay.

"I want to thank PayPal for supporting MEGA for such a long period. The pressure of Hollywood and the US government was just too big," said Kim Dotcom , founder of MEGA. Then he calls his followers to go use bitcoin now.