search

IntegralDefense / ACE

Analysis Correlation Engine
Apache License 2.0
26 stars 10 forks source link

Create direct download links for mega.nz #228

Closed automationator closed 5 years ago

automationator commented 5 years ago

Like we have done with OneDrive and other file-hosting websites, we should generate direct download links for mega.nz. Internal reference: https://ace.local/saq/analysis?direct=879bda5c-175d-4a7e-b589-148c9f25a9d8#805d5cf7-f98e-477a-8740-1862995848df

Possible example on how to do so: https://gist.github.com/MBRCTV/b46993d1e584ce9640e73643856b0644

unixfreak0037 commented 5 years ago

Turns out this is annoying.

https://stackoverflow.com/a/28234342

Basically, you can get back an encrypted blob using the method described in that PHP script. But then you have to decrypt it using the shared key. While I'm sure it's possible to reverse engineer what they're doing, there are likely better ways to accomplish this, such as sandboxing the URL access via an actual browser and "clicking" on the download link.

I don't think writing software to interact with services like this in this way because they can change at any time.

unixfreak0037 commented 5 years ago

I'm going to close this issue and we'll look at creating a broader solution to deal with this kind of phish delivery.