Hackers Breach MEGA Chrome Extension To Steal Crypto Private Keys
Modern technologies, such as the internet, smartphones, and blockchain, are often touted as world-changing innovations, and while this may be the case, there are still glaring problems with the security of digital systems.
MEGA Falls Victim To Cybersecurity Breach
On Tuesday morning, concerned individuals across the web took to social media to reveal that malicious code had taken the place of MEGA’s chrome extension, which has been downloaded tens of millions of times across the globe. Some claimed that the updated code allowed the extension to gather sensitive data from popular websites across the internet.
At first, many believed that this hack only affected popular websites, like Google and Facebook, but upon further analysis, cybersecurity experts noted that the updated MEGA extension could grab sensitive data from crypto-related sites as well.
Ricardo Spagni, a well-known Monero developer, backed up this claim, telling his followers that Monero and Ethereum private keys could be stolen via the combination of MEGA Chrome (version 3.39.4 specifically) and the MyMonero and/or MyEtherWallet storage solutions.
Confirmed that it also extracts private keys if you login to MyMonero and/or MyEtherWallet in a browser with the extension installed. https://t.co/fpVK11zZ9Z
— Ricccarod Andsaskiaspagni (@fluffypony) September 4, 2018
The apparent hack was later corroborated by ZDNet, who released an in-depth report on the situation a few hours after the news originally broke. Citing analysis of the source code of the hacked MEGA extension, the technology publication stated that Amazon, Google, Microsoft, Github, MyEtherWallet, MyMonero, And IDEX were all affected by the cybersecurity breach.
The code could reportedly record usernames, passwords and other sensitive credentials that could be later used by hackers to wreak on the digital lives of victims. After gathering data, the extension would then send all of the sensitive information to a server located in Ukraine.
Although MEGA, a popular cloud storage solution founded by Kim Dotcom, he has yet to comment on this situation, Google employees have since taken action by removing the extension from the Chrome Store and also temporarily disabling the extension for users who already have it installed.
It is important to note that those using the MEGA Firefox add-on were not affected in this breach, which indicates that MEGA’s Chrome developer account was likely phished, leading to the attack on Tuesday morning.
Hackers Turn To Extensions As A Viable Method To Falsely Garner Crypto
As the blockchains backing popular cryptocurrencies are nigh impossible to crack, ingenious hackers have sought alternative methods to get their hands on consumer crypto assets, with extension hacking becoming a common occurrence. The hack of the MEGA extension comes only months after NewsBTC reported that Hola, a popular VPN extension, fell victim to a similar hack in July.
In a similar situation, hackers were able to hijack the account behind the Hola extension to phish Ethereum private keys by redirecting MEW users to a hacker-owned website.
The full extent of both the MEGA and Hola attacks are still unclear, but as many forward-thinking cryptocurrency investors say, “a hardware wallet is the most secure way to store your crypto holdings.”
Featured Image from Shutterstock
The post Hackers Breach MEGA Chrome Extension To Steal Crypto Private Keys appeared first on NewsBTC.
by nickchong on September 05, 2018 at 12:15PM