Tor Browser Release Exposed Users’ Operating Systems, While Compromised MEGA Extension Stole Credentials
Summary
The article reports that Tor Browser 8.0/8.5a1 exposed users’ operating systems in user-agent strings and that a compromised MEGA Chrome extension harvested credentials and cryptocurrency keys before an update was released.
Key points
- The article says Tor Browser 8.0/8.5a1 included users’ actual operating systems in user-agent strings, potentially making users easier to distinguish across sites.
- It describes steps to reset or modify the user-agent override through Tor Browser’s about:config settings.
- Zerodium reported a NoScript bug affecting Tor Browser 7.x that could allow embedded code to run even when scripts were set to be blocked.
- The compromised MEGA Chrome extension, version 3.39.4, reportedly harvested user credentials and cryptocurrency private keys; the article says it sent stolen data to a server for four hours.
- MEGA extension version 3.39.5 was available as an update. The article says the Firefox version was not compromised.
- The article also cites malicious JavaScript and compromised browser add-ons as risks to users’ privacy and security.
Article Details
- Event Type
- Security issues affecting anonymity tools, including a Tor Browser user-agent exposure and compromised browser extensions.
- Impact
- Tor Browser 8.0/8.5a1 could expose users’ actual operating systems through their user agents, potentially enabling identification or correlation across sites. A compromised MEGA.nz Chrome extension version 3.39.4 reportedly harvested credentials and cryptocurrency private keys and sent stolen data to megaopac[.]host. Other cited risks include malicious JavaScript and browser-data collection by Firefox add-ons.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | megaopac[.]host | The article identifies this as the server to which the compromised MEGA.nz Chrome extension sent users’ stolen data. |
People
Vendors
GoogleLast week, DarkOwl analysts discovered a compromised version of the official Google Chrome extension for MEGA.nz, version 3.39.4, was published with malicious codes to harvest user credentials and private keys forMEGA.nzLast week, analysts found the official Chrome extension for MEGA.nz’s file sharing service was harvesting sensitive user data; while Tor Project’s latest browser release based on Firefox Quantum, was deployed withMozillaTor’s Browser, developed collaboratively with Mozilla, allows users with any operating system (OS) to freely visit clearnet, deep web, and darknet anonymous websites or sites that might be blocked in countries with
Products
NoScriptto 8.0/8.5a1, might want to reconsider as Zerodium released yesterday on Twitter details around a NoScript “bug” discovered in all Tor Browser 7.x versions that subjects the user to embedded code on the hiddenTor BrowserWith little to no configuration changes nor detailed understanding of networking protocols, Tor Browser prevents somebody watching your Internet connection from learning what sites its users visit and thwarts the sitesWeb SecurityIn August, Mozilla released a list of compromised add-ons which included one called “Web Security,” a security-centric Firefox extension with over 220,000 users, that was caught sending users’ browsing histories to a