Hello, welcome to the Thursday, September 6th, 2018 edition of the Santernet Storm Center's

Stormcast. My name is Johannes Ulrich. And I'm recording from Amsterdam, Netherlands.

Mega, the New Zealand company that offers end-to-end encrypted cloud storage has had its Google Play account compromised.

The compromised account was then used to distribute an updated version of the Mega Chrome plugin.

The updated version did then ask users for access to usernames and passwords and promptly exfiltrated

usernames and passwords that were entered into Google Chrome. Apparently, the compromise happened

on Tuesday around 1430 UTC. If you installed this plugin after this time or if you already had it installed but the plugin

auto updated, then your passwords may have gotten lost.

The plugin also went after my ether valid and my Monero passwords and it appears that the group behind this compromise has also been

hunting for crypto coins in the past using different illegal means.

And in installing software packages, whether it's a toolbar like in this mega example or whether it's a

Python package, is always a somewhat risky business.

So it shouldn't be a surprise that you have to be careful when you're installing Python packages,

not just because you may be importing malicious code, but Python packages can actually execute code at install time.

A blog post on GitHub warns about this apparently not very widely known feature and does suggest that you definitely verify hashes whenever you are downloading packages, use a user account,

not the root account, and finally always double check the package name. This is something that

we have seen a lot, for example, with NPM, but also sometimes with Python and like, that malicious packages

try to prey on people who misspell a package name and then install the wrong, and in this case,

malicious package. That's, of course, where in particular, this technique of executing code on

install time becomes handy because

you may never include this package in your code because of the typo, so the only time any code will run from the package is at install time.

And ESET security is reporting that the sandbox escaper Windows

...