Opera site served Blackhole malvertising, says antivirus firm

'No need to issue a press release', firm tells press


Opera has suspended ad-serving on its portal as a precaution while it investigates reports that surfers were being exposed to malware simply by visiting the Norwegian browser firm's home page.

Malicious scripts loaded by portal.opera.com were redirecting users towards a malicious site hosting the notorious BlackHole exploit kit, said a Romanian anti-virus firm BitDefender, which said it had detected the apparent attack on its automated systems. BitDefender said it promptly warned Opera after it detected the problem on Wednesday. It seems likely the scripts had been loaded through a third-party advertisement, a practice commonly known as malvertising.

Opera has yet to confirm the problem, but has disabled advertising scripts on its portal in case they are tainted. The browser firm says:

We are investigating the claim, and while we are working with this, we have taken some precautionary measures just to be safe, such as disabling the ads temporarily on portal.opera.com. We disabled ads yesterday [Wednesday], right after becoming aware of the claim, as a standard precaution and the ads had been disabled for several hours when Bitdefender issued a press release.

A blog post by BitDefender claimed that cybercrooks were using obfuscated script to hide the attack. The security firm said Opera fans had been exposed to attack simply by firing up the popular alternative browser software.

"The hidden and obfuscated piece of code in the Opera Portal homepage inserts an iFrame that loads malicious content from an external source," BitDefender explains. "If the Opera user hasn’t changed their default homepage, active malicious content is loaded from a third-party website whenever they open their browser."

In controlled tests, BitDefender researchers were served with a PDF-based exploit designed to infect an unlucky user with a freshly compiled variant of the infamous ZBot (ZeuS) banking Trojan. The exploit was served up from a (likely compromised) server in Russia, according to BitDefender. It's unclear how many people might have been exposed to this drive-by-download-style attack from Opera's portal, much less how many surfers might have been infected.

"We have no indications that anyone was infected before or after we disabled the ads yesterday [Wednesday]," an Opera spokesman told El Reg.

"Malvertising" incidents are far from rare. Previous victims have included Spotify, the London Stock Exchange, The Pirate Bay, ITV.com and Major League Baseball, among many others. Diagnosing and resolving tainted ad problems tends to be far trickier than cases where a web server itself is running malicious script, so Opera is wise to suspend ad-serving while it looks into the potential problem. ®

Similar topics

Broader topics


Other stories you might like

  • Robotics and 5G to spur growth of SoC industry – report
    Big OEMs hogging production and COVID causing supply issues

    The system-on-chip (SoC) side of the semiconductor industry is poised for growth between now and 2026, when it's predicted to be worth $6.85 billion, according to an analyst's report. 

    Chances are good that there's an SoC-powered device within arm's reach of you: the tiny integrated circuits contain everything needed for a basic computer, leading to their proliferation in mobile, IoT and smart devices. 

    The report predicting the growth comes from advisory biz Technavio, which looked at a long list of companies in the SoC market. Vendors it analyzed include Apple, Broadcom, Intel, Nvidia, TSMC, Toshiba, and more. The company predicts that much of the growth between now and 2026 will stem primarily from robotics and 5G. 

    Continue reading
  • Deepfake attacks can easily trick live facial recognition systems online
    Plus: Next PyTorch release will support Apple GPUs so devs can train neural networks on their own laptops

    In brief Miscreants can easily steal someone else's identity by tricking live facial recognition software using deepfakes, according to a new report.

    Sensity AI, a startup focused on tackling identity fraud, carried out a series of pretend attacks. Engineers scanned the image of someone from an ID card, and mapped their likeness onto another person's face. Sensity then tested whether they could breach live facial recognition systems by tricking them into believing the pretend attacker is a real user.

    So-called "liveness tests" try to authenticate identities in real-time, relying on images or video streams from cameras like face recognition used to unlock mobile phones, for example. Nine out of ten vendors failed Sensity's live deepfake attacks.

    Continue reading
  • Lonestar plans to put datacenters in the Moon's lava tubes
    How? Founder tells The Register 'Robots… lots of robots'

    Imagine a future where racks of computer servers hum quietly in darkness below the surface of the Moon.

    Here is where some of the most important data is stored, to be left untouched for as long as can be. The idea sounds like something from science-fiction, but one startup that recently emerged from stealth is trying to turn it into a reality. Lonestar Data Holdings has a unique mission unlike any other cloud provider: to build datacenters on the Moon backing up the world's data.

    "It's inconceivable to me that we are keeping our most precious assets, our knowledge and our data, on Earth, where we're setting off bombs and burning things," Christopher Stott, founder and CEO of Lonestar, told The Register. "We need to put our assets in place off our planet, where we can keep it safe."

    Continue reading

Biting the hand that feeds IT © 1998–2022