Hacked Opera starts spinning like crazy


Although the Opera web browser client is no longer the big 'little player' that it used to be having long since been eclipsed by the likes of Chrome and Firefox in the Internet Explorer alternatives stakes, it can still claim more than 300 million users and a place as world’s most popular browser for mobile phones. So when you learn that Opera Software, the company in Norway behind the Opera browser, has admitted that its internal network infrastructure has been hacked you have every right to be a little concerned. That concern may grow a bit when you discover that "at least one" code-signing certificate was stolen. It starts getting a tad on the large side when, in the next breath, Opera Software also admit that certificate has been used to "distribute malicious software which incorrectly appears to have been published by Opera Software, or appears to be the Opera browser" according to an official spokesperson.


However, for me, my concern turns obese when the public announcement of the hacking and that certificate theft, along with the admission of the malicious software distribution as a direct result, is spun out under the headline of: "Security breach stopped". Erm, hang on a moment, that rather suggests that there is nothing to see here, that the security at Opera Software was all good and the bad guys were thwarted. Or at least it would if the statement that follows didn't take a whole week to arrive after Opera discovered security had been breached, didn't refer to that code-signing certificate theft and subsequent malware distribution as being of 'limited impact' and almost write off the fact that "a few thousand Windows users who were using Opera between 01.00 and 01.36 UTC on June 19th, may automatically have received and installed the malicious software".

Kudos to Opera Software for going public, that's always the best policy. I'm no advocate of immediate knee jerk reaction disclosures either as they invariably land the publisher in hot water. However, a week to make this announcement? C'mon people. Kudos to Opera Software for rolling out a new version of Opera which will use a new code signing certificate as well. But to say it's doing this "to be on the safe side" when the company has already admitted a malware version has been distributed really does stink of letting the PR men take hold of the security disclosure reigns. After all, as Malwarebytes Senior Security Researcher, Jerome Segura, states that "it would appear as though the bad guys went as far as pushing the update onto some of Opera’s 300 million users for a 36-minute period, meaning they had access to Opera’s infrastructure during that time".

"Users are strongly urged to update to the latest version of Opera as soon as it is available, keep all computer software up to date, and to use a reputable anti-virus product on their computer" the official Opera Software statement reads. But I'd rather be reading less of the damage limitation spin and polish, and more on how the hackers got in and what steps have been taken to prevent this happening again. As security expert Graham Cluley says "in these situations, transparency is often the only way to turn a potential disaster into an opportunity to rekindle some love from users".

About the Author

A freelance technology journalist for 30 years, I have been a Contributing Editor at PC Pro (one of the best selling computer magazines in the UK) for most of them. As well as currently contributing to Forbes.com, The Times and Sunday Times via Raconteur Special Reports, SC Magazine UK, Digital Health, IT Pro and Infosecurity Magazine, I am also something of a prolific author. My last book, Being Virtual: Who You Really are Online, which was published in 2008 as part of the Science Museum TechKnow Series by John Wiley & Sons. I am also the only three times winner (2006, 2008, 2010) of the BT Information Security Journalist of the Year title, and was humbled to be presented with the ‘Enigma Award’ for a ‘lifetime contribution to information security journalism’ in 2011 despite my life being far from over...

rubberman 1,355 Nearly a Posting Virtuoso Featured Poster

It is unfortunately that this has happened to Opera. They are our biggest competitor in the mobile browser arena and we have a LOT of respect for them. The fact is that this can happen to anybody. Let your guards down in any small area for just a minute and some opportunistic creep will exploit it. We learn from our mistakes, and what differentiates the good companies from the bad is how they deal with it. Admit you screwed up, fix it, and move on are the hallmarks of a good company - one you can trust.

That said, we (Nokia) are going to eat Opera's lunch! At least in the mobile universe. :-) At least that's what we'd like to think... :lol:

BigPaw 17 Master Poster

Opera has been one of, if not the, most innovative browser developers since perhaps Netscape. It's good to know this hasn't floored them.

Member Avatar

However, for me, my concern turns obese when the public announcement of the hacking and that certificate theft, along with the admission of the malicious software distribution as a direct result, is spun out under the headline of: "Security breach stopped"

I heard this on the news a week ago. I am a bit surprise that someone was able to do this Opera browser.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts learning and sharing knowledge.