7

recently i found on my Firefox Profil, under .../storage/.../idb/ a File named "https+++mega.co.nz", i looked inside those files, some are encrypted (couldnt read it in Notepad++), but i found 27 Files with no Type, all this Files are 1024 kb, and the Content of those files look like this:

monoethanolamine
monoethy
monoethylamine
monofa`sica
monofa`sico
...

My first thought is, that this are possible Passwords, used for e. g. password dictionary attacks. So my question, can a website use my browser/computer (CPU, GPU, RAM ...) to crack passwords (i think of using JavaScript)? If its not possible, why are those files stored on my computer?

  • 1
    Yeah, that does look like it could be doing that, but... are you sure these files aren't part of the storage created when you download files from mega through your browser? Those may be the randomly-generated passwords that could decrypt the files you're downloading. – Mark Buffalo Nov 23 '15 at 19:34
  • 3
    Be aware that Kim DotCom is not in control of Mega anymore (techcrunch.com/2015/07/31/…) after a said "hostile take over". He said that he does not put anymore trust in Mega itself from now on. So, they may really be trying to decrypt your files while you are using it. – DarkLighting Nov 23 '15 at 19:48
  • 3
    you could try emailing mega.co.nz at support@mega.nz and see what kind of explanation they give you – coderworks Nov 23 '15 at 19:49
3

Yes, it is possible. But, based on my testing, it's not likely.

What are these files?

During my tests, I was able to locate binary files in my Firefox profile directory at this path:

<PROFILE DIRECTORY>/storage/temporary/https+++mega.nz/asmjs/

This suggests that the files contained therein are temporary files for asm.js. Information about these files is sparse, but this tweet from a self-reported Unity employee provides some substantiation (because Unity worked with Mozilla on game development with asm.js).

On my system, these names of these files followed the template module<NUMBER>. While investigating the contents of these files, I was unable to find any likely passwords, even after registering for an account inside the add-on.

Where did these strings come from?

The strings you pulled from those files are certainly suspicious. I have been unable to recover anything similar on my own system, but there is another explanation.

The add-on includes Dropbox's zxcvbn library for calculating password strength. It is possible that asm.js attempted to optimize that code, resulting in password-like information being stored to your hard drive.

Using only words found in zxcvbn's dictionary, I was able to reconstruct some of the potential passwords you listed:

  • monoethanolamine: mono + ethanol + a + mine
  • monoethylamine: mono + ethyl + a + mine

The other passwords were likely generated using other rules (such as character substitution).

What can we conclude?

The files you found are most likely temporary files generated by Firefox. Specifically, when asm.js tries to optimize the zxcvbn code, it likely generates the temporary file containing some of the strings you found.

However, it could also be the case that the extension is using the zxcbvn wordlist to perform bruteforce attacks. A more extensive review of the code is needed to determine if that is the case.

  • i tryed to reproduce it, but it didnt work (got the same result like you). I looked inside my firefox profile, but there is not the same result like my old firefox profile from 2014 (its a old backup), so i made a .zip-File for you, if you want to look further. Its 258 MB big!!!! dl.dropboxusercontent.com/u/23100716/… – Rep Nov 25 '15 at 13:27
  • @Rep With that information, I suspect that the older versions of Firefox used a different algorithm to decide when to optimize. Also, the file download is giving a 404 error. – Austin Hartzheim Nov 25 '15 at 13:42
  • Yes, i thought so too, i looked inside the sqlite files, not very informative for me. The Upload takes some time, please try again in 15-30 Min. . – Rep Nov 25 '15 at 13:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.