Developers › A Journal from Behind the Trenches

Beware of fake My Opera activation e-mails

July 16, 2010 · by Haavard

It looks like someone has taken the standard activation e-mail for My Opera, and changed the links to point to a malicious site. We started receiving reports on this today, and others, like Websense and Softpedia have picked up on it.

Readers' comments 39

Left under the original article, as archived.

Remco LantingFriday, July 16, 2010 10:25:55 AM
opera.com has an SPF record, so this should be marked as spam in most email services
nvrs131Friday, July 16, 2010 1:35:24 PM
it's sad 2 hear that. . Opera team should take special action
Charles SchlossFriday, July 16, 2010 2:19:20 PM
Good to know, will report any I see
Crysta T. LaceyFriday, July 16, 2010 3:33:53 PM
Thanks Haavard,

I put it up on my FB page. FB blocked your blog as spammy and malicious, so I C/Ped and attach manually and it went through. Another work around when the first 2 get the FB block for Opera links is the attach in a message and then SHARE it to my profile. Sure wish this ongoing FB problem with Opera could be resolved!

Town
Cutting SpoonFriday, July 16, 2010 4:15:58 PM
Yeah, it's funny given that Facebook has provided one of Opera's third-party download mirrors. Where's the love?

On a more serious note, the malicious page could possibly be de-listed from DNS servers and/or removed by the server/colo operator. Or some highly enterprising soul might just deface those idiots' page.
CristobalFriday, July 16, 2010 5:17:48 PM
Thanks for the advice. I read it on twitter.
ASRUL SYAMFriday, July 16, 2010 6:30:21 PM
thank you very much for your notice

and Team My Opera should immediately review each Opera browser has been launched!.
Thelomen ToblakaiSaturday, July 17, 2010 7:27:50 AM
Wrong - you are one of the very few community operators in the world that actually CAN do something about it. Both M2 and your anti-phishing security should be updated to target this type of malicious activity, and with control of both ends you should be able to do it better than most. Also, plaster this info all over your official webspace. From your post it doesn't seem like Opera takes this very serious, which is rather disappointing.
ValeriySaturday, July 17, 2010 12:22:46 PM
It always useful to check all headers of such suspicious emails. Headers are unveiling more truth =)
OblahblahSaturday, July 17, 2010 7:36:21 PM
I think Opera is ACTING like there is nothing they can do...good idea,Opera.
prd3Saturday, July 17, 2010 8:12:24 PM
Originally posted by toblakai:

Wrong - you are one of the very few community operators in the world that actually CAN do something about it. Both M2 and your anti-phishing security should be updated to target this type of malicious activity, and with control of both ends you should be able to do it better than most. Also, plaster this info all over your official webspace. From your post it doesn't seem like Opera takes this very serious, which is rather disappointing.

Who the hell are you?

You are clearly completely ignorant, not to mention obnoxious and bigoted.

There is NOTHING Opera can do in M2. To do something, they would have to take over M2. M2 is a local client, not an online app.

There is NOTHING Opera can do about phishing databases. They do NOT have their own. They are just licensing from other companies.

So who the hell are you to come here and spew your ignorant, hateful nonsense?

Pathetic indeed.
prd3Saturday, July 17, 2010 8:15:27 PM
Originally posted by moonflowr:

I think Opera is ACTING like there is nothing they can do...good idea,Opera.

There is NOTHING Opera can do about this. Their systems are not being used to send these messages. Why are you being such an ignorant bigot?

Also, why do you and that other disgusting ignorant guy have females as avatars, when you are clearly male nerds whose closest contact with females is looking at porn?
Cutting SpoonSaturday, July 17, 2010 9:09:07 PM
Did the MyOpera guys say that the new interface will include an https login option? Can fraud protection be invoked for non-https pages? I'd hope to see a discussion of this on the Security blog.
sorinTuesday, July 20, 2010 10:33:51 AM
anyway @prd3, Opera should try to do something to solve the problem, and never say "we can do nothing" !
OblahblahTuesday, July 20, 2010 5:40:51 PM
wow, somebody has issues, please do seek counseling.
Cutting SpoonTuesday, July 20, 2010 6:10:32 PM
http://www.mywot.com/en/scorecard/www.replica-handbags-shop.com

It'd be nice if WebOfTrust could be an included search...
Charles SchlossTuesday, July 20, 2010 6:29:17 PM
Originally posted by hellspork:

It'd be nice if WebOfTrust could be an included search.

http://www.mywot.com/en/download Look at the Bookmarklet
Lanzaderas Jesrel DTuesday, July 20, 2010 9:54:09 PM
make an action about it!
prd3Tuesday, July 20, 2010 10:28:02 PM
Originally posted by ste-ven:

Opera should try to do something to solve the problem, and never say "we can do nothing" !

Are you a bit thick?

IF THERE IS NOTHING OPERA CAN DO, THEN THEY SHOULD OF COURSE SAY SO.

Do you understand now?

Christ.
tashaWednesday, July 21, 2010 7:59:28 PM
I rll tht you dn the best thanks
Blaz(ž) PristavThursday, July 22, 2010 5:13:05 AM
Mod edit: Please do not post email addresses in public.
Thelomen ToblakaiSaturday, July 24, 2010 5:26:37 PM
Originally posted by prd3:

There is NOTHING Opera can do in M2. To do something, they would have to take over M2. M2 is a local client, not an online app.

M2 is the (old?) name of Opera's inbuilt mail client, and is fully controlled by Opera. Opera can both pre-define spam rules against these kind of emails and/or make a special filtering system for these emails beyond the capabilities of the user-controlled rule filtering system.

Originally posted by prd3:

There is NOTHING Opera can do about phishing databases. They do NOT have their own. They are just licensing from other companies.

Opera can add their own preventive measures in addition to any anti-phishing system they are currently implementing through third-party phishing databases.

It may be hard to get it right and they may decide it will cost too much effort, but Opera controls both ends in this situation - there is in fact little they can't do.
prd3Saturday, July 24, 2010 6:20:52 PM
Originally posted by toblakai:

M2 is the (old?) name of Opera's inbuilt mail client, and is fully controlled by Opera.

No it isn't. They can't suddenly change it overnight. To do anything at all, they need to release a new version, and by the time that happens, this spam thing is long gone anyway.

Opera can both pre-define spam rules against these kind of emails and/or make a special filtering system for these emails beyond the capabilities of the user-controlled rule filtering system.

No they can't, and it's pointless.

Also, these mails don't target Opera users specifically, so even if Opera could do something with their mail client (which they can't), the vast majority would still get these.

Opera can add their own preventive measures in addition to any anti-phishing system they are currently implementing through third-party phishing databases.

Oh yeah? And what preventive measures would that be?

It may be hard to get it right and they may decide it will cost too much effort, but Opera controls both ends in this situation - there is in fact little they can't do.

WRONG. Opera does NOT control both ends:

SENDER: Spammer. Not using any of Opera's products or services. Nothing Opera can do.

TRANSFER: Not using Opera's mail servers. Nothing Opera can do.

RECIPIENT: Victim. Most aren't even using Opera. And even if they are there's nothing Opera can realistically do to help this extremely small minority.

So as you can see Opera controls NEITHER end.
Thelomen ToblakaiSaturday, July 24, 2010 7:22:17 PM
As I don't want to be a troll-feeder I will end this here, knowing that whatever I write, prd3 will always reply with another zealot comment.
hexterSaturday, July 24, 2010 10:51:08 PM

Originally posted by toblakai:

As I don't want to be a troll-feeder I will end this here, knowing that whatever I write, prd3 will always reply with another zealot comment.

While completely off topic, I have to say that I love your name
prd3Monday, July 26, 2010 9:42:04 AM
Originally posted by toblakai:

As I don't want to be a troll-feeder I will end this here, knowing that whatever I write, prd3 will always reply with another zealot comment.

The words of someone who knows he's been owned. Your ignorance caused you to corner yourself with nonsense and contradictions. Fail.
Erik ShikerinMonday, July 26, 2010 10:34:14 AM
quit trolling!
sorinMonday, July 26, 2010 6:10:48 PM
@prd3 should have an interdiction to post here
Duncan WilliamsTuesday, July 27, 2010 2:21:27 PM
I have had a number of malware attacks lately while using opera and have written a short blog about it on my opera profile. Only last night I was warned by Microsoft Security Essentials - do not enter this site as it contains malware. more info at:

http://my.opera.com/DuncanWilliams/blog
Cutting SpoonWednesday, July 28, 2010 1:37:05 AM
This is often an issue with plugin security, it can not often be fixed by the browser vendor.

EDIT: My full response is in the relevant post on your blog.
Duncan WilliamsWednesday, July 28, 2010 5:12:38 PM
thanks for comments and in no way do I hold opera responsible for anything other than a range of excellent products. and while I am at it the turbo mode saves me a lot of money > In Australia I am paying $50 for 2 gig of internet access > with turbo enabled I get upto 6 gig (compression of data) add that up > $150 for $50 > no other browser can do that. and my-opera is better than facebook or my-space in a lot of ways. and who needs outlook or any email product when opera does the lot. and why use mirc when you got irc built in. etc - not sucking just love the product.. I believe that malware must be attacked by security software not the browser. but thats just my opinion.
Cutting SpoonWednesday, July 28, 2010 5:20:39 PM
Well, it's always worthy of discussion. Have you enabled low-bandwidth mode on the mail client? For POP3 mail, it only grabs the first few words of each mail and waits before downloading attachments; for IMAP you can set it to only download selected messages.

For some websites, the [R-click->Edit Site Preferences->Content->Animated Images] checkbox can keep old-style animated GIF banners from loading.
Cutting SpoonWednesday, July 28, 2010 7:10:37 PM
I've confirmed that on-demand plugins work fairly well in normal browsing mode, the checkbox is found in User Prefs portion of opera:config.
Chima GodswillFriday, July 30, 2010 10:38:13 AM
Good to hear that. Will report if any
kitishoFriday, July 30, 2010 4:38:34 PM
shocking!!
UDTuesday, August 3, 2010 6:15:25 AM
Opera is really mind blowing Server...
Herry BenthoThursday, August 5, 2010 2:32:34 PM
tank opera
ask meFriday, August 6, 2010 11:39:16 AM
keka opera
tashaFriday, August 6, 2010 8:52:50 PM
its fr rll I like that