Security breach stopped

Readers' comments 50

Left under the original article, as archived; 1 page of comments could not be recovered.

• 

  LeoCGWednesday, June 26, 2013 5:26:45 PM

  Does it affect also Opera 15?
  
  
• 

  AoyagiWednesday, June 26, 2013 5:50:05 PM

  So I presume (and hope) that Link (passwords and the data itself) is safe, right?
• 

  rseilerWednesday, June 26, 2013 6:19:17 PM

  Did you mean to say "who were *installing* Opera between" those hours? Meaning that the Opera installer was impacted for a short time? Because otherwise I don't understand how using Opera would be related to what happened.
• 

  QuHnoWednesday, June 26, 2013 6:23:30 PM

  It is possible that a few thousand Windows users, who were using Opera between 01.00 and 01.36 UTC on June 19th, may automatically have received and installed the malicious software.

  Thanks for the warning but 2 questions:
  How?
  What?
  
  Please update this blog post as soon as possible because some Opera installs are in companies and admins love to know the threads they are facing.
• 

  FataLWednesday, June 26, 2013 6:27:44 PM

  Was they able to steal Opera 12 source code?
• 

  Charles SchlossWednesday, June 26, 2013 8:49:17 PM

  Opera always good on
  
  I guess it is time to double check that all server software and users machines have updated software
  
  Talked about on http://nakedsecurity.sophos.com/2013/06/27/opera-breached-certificate-stolen/ & http://grahamcluley.com/2013/06/opera-hacked-code-signing-certificate-stolen-used-to-spread-malware/ & http://arstechnica.com/security/2013/06/attackers-sign-malware-using-crypto-certificate-stolen-from-opera-software/
• 

  MaciejWednesday, June 26, 2013 11:16:43 PM

  So does the "update" change Opera files or just steal FTP and maybe other passwords (as reported by virustotal)?
• 

  Mark GodeckeThursday, June 27, 2013 2:41:23 AM

  I don't understand. If the certificate was expired, how could it be used to push out malware? Would my current version of Opera still trust this 'expired' certificate?
  
  You also must explain why it took a week to notify your users that they have had malware pushed to their machines. This is not acceptable.
  
  I really like Opera as a product. Please help restore my faith in Opera the software company.
• 

  netwolfThursday, June 27, 2013 8:43:03 AM

  Even though that's actually pretty bad news, there also a bright side: we'll see at least one more _real_ Opera build (12.x branch)
• 

  ledowThursday, June 27, 2013 9:05:35 AM

  Er, yeah, we need more information here.
  
  How could it have been pushed to my computers?
  What form would it take (an MD5 and a VirusTotal report is useless here)?
  What impact would it have?
  Why has it taken until now to even announce this?
  Why is an expired certificate allowed to do anything?
  Why isn't that certificate checked with a revocation list?
  If it is, why are you issuing new versions?
  
  And, yes, if it's not a 12.x build, then you can forget it. I'll just block Opera from accessing whatever update sites it's been pulling this junk down from (without my permission!) and carry on using the current version.
• 

  ir193Thursday, June 27, 2013 9:19:40 AM

  How I wish that opera12.15 and opera9.64 source was stolen.
  So the presto will live on
• 

  J7NThursday, June 27, 2013 10:27:47 AM

  I wish for the above too, and also for the developers be as eager to release one more Opera 12 version containing all the components that reside online. If anyone really received malware, they deserved it for having automatic updates enabled, allowing new software to be automatically downloaded!
• 

  Mağruf ÇolakoğluThursday, June 27, 2013 11:21:55 AM

  Here is some news and we need more clear info. Will make update Opera 15 immediately?
  http://nakedsecurity.sophos.com/2013/06/27/opera-breached-certificate-stolen/
  
• 

  Kim Jong-IlThursday, June 27, 2013 12:38:24 PM

  So, when I still use 12.15 (and probably do not never ever update to 15) I am on safe side? In Opera 12.15 I don't have auto update? At least I don't use it.
• 

  vux777Thursday, June 27, 2013 1:04:13 PM

  some guys on forum updated their versions to 12.16
  but there is not official release yet.
  
  http://my.opera.com/community/forums/topic.dml?id=1703102
  
  are you delaying new release so that we don't "hammer" your servers or...there is no 12.16 at all?
• 

  Asoka DissanayakeThursday, June 27, 2013 2:50:44 PM

  This is a good lesson so that in future more stringent measures can be adopted.
• 

  rseilerThursday, June 27, 2013 3:12:42 PM

  I still don't understand parts of the post, but it brings up an interesting point: an Opera rep over in the v15 blog mentioned that only the latest version of Opera is supported. So, once the extremely under-featured v15 is released, which probably isn't many weeks off, that's supposedly it for v12.1x--despite many of us who actually want features in our browser continuing to use it for probably many, many months to come (I can't imagine new Opera coming anywhere close to parity with "old" Opera this year, and maybe not next).
  
  Considering the circumstances of this particular transition for Opera, you should support (i.e. security updates) the latest v12.1x for at least a year after v15+ is released.
• 

  ricksperThursday, June 27, 2013 3:13:43 PM

  Could that be why I am getting a second instance of Opera opening with three tabs, one of which warns me that I need to update my Media Player.
• 

  MaciejThursday, June 27, 2013 7:10:17 PM

  Originally posted by ledow:

  ...
  What impact would it have?

  
  In absence of official information I can answer that (based on VirusTotal information):
  1. The "update" file was run as a program.
  2. It then searched for FTP configuration of: Total Commander, CuteFTP, FlashFXP, FileZilla, ExpanDrive, CoffeeCup FreeFTP (and maybe some other).
  3. Stolen passwords(!) were probably sent to some server (probably ngnetworld-com or an anonymous one - identified by IP).
  4. It might have messed up WinRAR.
  5. Most probably it installed another program (my guess is that it's a key logger to steal more passwords).
  
  So if you are affected
  1. Run a scan or two with different Anti Virus programs (Kaspersky has a free scanner, you can also use AVG or Avast now).
  2. While scanning change ALL your passwords for services you made connections from your computer. BUT do it from a DIFFERENT computer.
  3. Check the FTP servers you've made connections to for malware (most change index files like index.html, index.php, default.aspx).
• 

  Mark 'Tarquin' Wilton-JonesThursday, June 27, 2013 7:41:05 PM

  Some good questions raised in the previous comments. I'll try to answer the important stuff here.
  
  

  So I presume (and hope) that Link (passwords and the data itself) is safe, right?

  
  Correct, we have not found any evidence indicating otherwise. Note that in any case, Opera Link data is encrypted using a password known only to the user.
  
  

  Was they able to steal Opera 12 source code?

  
  No. From your emoticon, I am not certain if you consider that a good or a bad thing though
  
  

  Does it affect also Opera 15?

  
  Opera 15 uses the same autoupdate servers as Opera 12, so it would still be possible to have been affected. See more details below. Note that we are not aware of Opera itself being affected. The malware did not affect the Opera installation itself.
  
  

  So does the "update" change Opera files or just steal FTP and maybe other passwords (as reported by virustotal)?

  
  The malware is a Trojan, so it could potentially install more malware later.
  
  

  If the certificate was expired, how could it be used to push out malware? Would my current version of Opera still trust this 'expired' certificate?

  
  The certificate used was our old code signing certificate, for instance Opera 12.00 was signed with this. You can download the file and view the certificate through its properties. Attempting to install this file works in common scenarios, even though the certificate is expired. This is controlled by the OS, not us, although in the future it would certainly be possible to run our own checks on the certificate of downloaded autoupdates, in addition to those imposed by the OS.
  
  

  You also must explain why it took a week to notify your users that they have had malware pushed to their machines.

  
  It took us some time to determine the extent of the attack, and find out exactly what had happened. The best way forward would have been to release a new version of Opera, with a new certificate, at the same time as we published these details. We received the new certificate on Monday, but due to technical issues, we were not able to ship an update as of yesterday, so we decided to release the details even without the update, rather than wait any longer.
  
  

  Did you mean to say "who were *installing* Opera between" those hours? Meaning that the Opera installer was impacted for a short time? Because otherwise I don't understand how using Opera would be related to what happened.

  
  tl;dr: We meant "who were using".
  
  In recent Opera versions, autoupdate happens automatically, and without user interaction. If you look at the "Additional information" tab of the virustotal link in the post, you can see what file name the malware disguised itself under. If there is a redirection in front of one of our autoupdate servers, users can be sent to locations we have no control over.
  
  We know what time period this redirect was in place for, and we know how many users were sent to the affected server, but we have no way of identifying these users. We also have no way of knowing what happened to them once they were redirected away, but we have strong reasons to believe at least some of them were presented with malware. Even for users who were presented with malware, we don't know how many actually installed it, it might have failed due to issues with the certificate, being blocked by anti-virus, or due to problems with the connection or download. Unfortunately, not all versions of Windows check the certificate, and some users may have disabled the UAC protection. All we have is an upper bound of several thousand possibly-affected users.
  
  

  Please help restore my faith in Opera the software company.

  
  Though a few thousand out of a user base of several hundred million users might not seem much, we take this issue very seriously, and are doing what we can to limit the impact. For users worried about malware on their own computer, a virus scan with a scanner known to catch the Trojan is recommended. This incident has ironically enough helped us find several potential areas of improvement, where we can make our security better in the future, for instance additional certificate checks as mentioned above.
• 

  conspicuouscarlThursday, June 27, 2013 9:59:42 PM

  You rats!
  
  I read this and thought, "it's a good thing I always keep auto updates turned off on all of my software", and yet I looked at my settings anyway... you mofos turned it ON during some previous update? Thanks a lot, you shady jerks.
  
  Yet one more reason why Opera is going down hill. Pushing beta-quality garbage as an update fore Mobile, lawsuits against ex-employees, and now this.
• 

  Charles SchlossThursday, June 27, 2013 10:07:50 PM

  @tarquinwj is the cert in the CRL backlist and OCSP check?
• 

  vux777Thursday, June 27, 2013 10:09:24 PM

  ok, just a couple of things...
  
  1) If I disabled auto-update, that means that my Opera didn't pulled those certificates or been redirected to "other location"?
  
  2) some users mentioned that their Opera is updated to 12.16.
  Is that security update that you referring to?..And when will be available for the rest of the users?
  
  http://my.opera.com/community/forums/topic.dml?id=1703102
• 

  PengeThursday, June 27, 2013 10:10:20 PM

  Originally posted by tarquinwj:

  Originally posted by FataL:

  Was they able to steal Opera 12 source code?

  No.

  
  The hope for the survival of the best browser in the future is lost...
• 

  SchnellingerThursday, June 27, 2013 11:41:30 PM

  Originally posted by vux777:

  
  2) some users mentioned that their Opera is updated to 12.16.
  Is that security update that you referring to?..And when will be available for the rest of the users?
  
  http://my.opera.com/community/forums/topic.dml?id=1703102

  The last I would do at the moment is installing such a "security update", if there is not a single official mentioning of it. It would be nice by Opera ASA to clear things up regarding this strange "12.16". ASAP
• 

  LeoCGFriday, June 28, 2013 12:36:13 AM

  Originally posted by Schnellinger:

  The last I would do at the moment is installing such a "security update", if there is not a single official mentioning of it.
  It would be nice by Opera ASA to clear things up regarding this strange "12.16". ASAP

  
  
  Have you read the post?
  
  
• 

  Sigbjørn VikFriday, June 28, 2013 7:03:36 AM

  Originally posted by vux777:

  some guys on forum updated their versions to 12.16
  but there is not official release yet.
  
  http://my.opera.com/community/forums/topic.dml?id=1703102

  The updated version will be called 12.16. We built one version already, but it ran into some technical problems, so we have to build a new one. Unfortunately, the Linux version made it into a public repository, and some users installed it from there before we had a chance to remove it again. Note that Linux users were not affected anyhow. If you don't run into any problems with the 12.16, you may as well keep it, but note that Opera will not autoupdate to another version of 12.16, so you will have to install the official version manually later.
• 

  vux777Friday, June 28, 2013 7:09:12 AM

  Originally posted by Sigbjorn:

  The updated version will be called 12.16. We built one version already, but it ran into some technical problems....

  
  
  Ok, thanx for clearing that.
  
• 

  Rafael LuikFriday, June 28, 2013 7:39:19 AM

  Originally posted by Sigbjorn:

  If you don't run into any problems with the 12.16, you may as well keep it, but note that Opera will not autoupdate to another version of 12.16, so you will have to install the official version manually later.

  Then make the update have 12.17 as the version number. Phew, and isn't the auto-updater able to differentiate new versions via the build number?
  Seriously sometimes Opera makes me wonder about its intelligence.
  
  About the breach you stopped: me and a lot of people including specialized security journalists couldn't understand anything about how the breach occurred and what were the consequeces. People received malware automatically? Auto-updater was compromised then? Shouldn't the new version be ready and already installed in users machines by now? One more question why does it require you to update the browsers that used that certificate (is there any risk on using 12.15 or 12.1.5 in Android)?
• 

  Dave SergeantFriday, June 28, 2013 9:35:16 AM

  Thanks Mark for the detailed explanation, it is much clearer now.
  
  So, the basic breach was hacking the update.opera.com server, presumably by placing a rogue .htaccess file in it, so when it was accessed during the mentioned timescale everybody was redirected to a dodgey site that tried to install malware. Such .htaccess hacks are very common. The malware was made to look like a legitimate file by signing it with an Opera certificate (it could quite well have been signed with any other signed certificate stolen from anywhere else on the web). Note that we are talking about software signing certificates, these have nothing whatsoever to do with https:// SSL certificates.
  
  Depending on the user, the malware would no doubt be stopped by installed AV and UAC prompts.
  
  Users who had disabled Opera updates would not necessarily be immune, because even with updates disabled the browser still checks periodically for browser.js updates.
  
  The rogue .htaccess file has obviously now been deleted from the servers at the time mentioned so any further infections are impossible. Presumably the server logs showed when it was installed hence the two times can be accurately determined. Top marks for Opera finding and removing this in record time. Hopefully they have taken steps to ensure such a breach does not occur again.
  
  Since the times are in the middle of the night in the UK my computer was quite definitely turned off...
  
• 

  TuttleFriday, June 28, 2013 10:29:49 AM

  You had been lucky on this one.
  But a good point is, you will strengthen your security policy. At least regarding the signing process and the private certificate key availability (more network segregation on this process ?).
  
  Thank you for letting us know.
• 

  dtrebbienFriday, June 28, 2013 12:47:04 PM

  Where can I find more information about the malware which might have been installed? What does it do? What is its name?
  
  Is there a way to quickly determine whether my computer was affected?
  
  Is there a free tool that can detect the malware?
  
  Are Mac users affected?
• 

  Dave SergeantFriday, June 28, 2013 1:21:36 PM

  It is not the opera browser that was infected. Rather ANY request to update.opera.com would be redirected to the malware site, whereupon the malware would be downloaded and installed from there (not from Opera). Checking for an updated browser.js goes to the update servers just the same as checking for a browser update. We have not been told what the name of the malware file was, almost certainly NOT opera.exe. The Opera browser files on Opera sites have not been affected at all.
  
  (perhaps Opera can confirm my interpretation).
  
• 

  QuHnoFriday, June 28, 2013 1:42:09 PM

  Originally posted by davews:

  We have not been told what the name of the malware file was, almost certainly NOT opera.exe.

  
  That's one of the reasons why they posted the link to virustotal:
  https://www.virustotal.com/en/file/8ecbca0de44c82d1c7ffced288aa68c1247bb1255693cd1c5747fb6cef394b43/analysis/
  
  Just click on "additional info".
• 

  Charles SchlossFriday, June 28, 2013 1:51:48 PM

  Originally posted by dtrebbien:

  Are Mac users affected?

  
  The malware only attacks Windows machines as it is a .exe
  
  

  Originally posted by dtrebbien:

  Is there a free tool that can detect the malware?

  
  Malwarebytes is one of them, there are others that are listed on the virustotal results, over time they should all be detecting the file
  
  

  Originally posted by dtrebbien:

  Where can I find more information about the malware which might have been installed? What does it do? What is its name?

  
  
  

  That's one of the reasons why they posted the link to virustotal: https://www.virustotal.com/en/file/8ecbca0de44c82d1c7ffced288aa68c1247bb1255693cd1c5747fb6cef394b43/analysis/ Just click on "additional info".

• 

  Mark GodeckeFriday, June 28, 2013 4:35:31 PM

  Thank you so much for answering my questions. I feel like I have a pretty good understanding of what happened now.
  
  To summarize, when installing a new program in Windows, the user receives a warning that they have to click past in order to actually begin the installation. If Windows detects the installation program is digitally signed by a trusted certificate, it skips displaying this warning to the user. To enable 'silent' automatic updates, Opera signs its installation programs. The hackers compromised an old certificate (which Windows trust) and also Opera's update server. That enabled them to use Opera's silent automatic update to install the code of their choice on the victim's machine.
  
  Again, thanks for clarifying this. It definitely makes me feel better to know there are individuals at Opera who respond to user feedback and who are committed to openness as the best response to security breaches. Keep up the good work.
  
• 

  webtaxFriday, June 28, 2013 4:57:01 PM

  for the people that want to delete opera link stuff, here is a guide from tamil http://my.opera.com/Tamil/blog/how-to-delete-data-from-opera-link
• 

  SchnellingerFriday, June 28, 2013 5:59:56 PM

  Originally posted by Sigbjorn:

  We built one version already, but it ran into some technical problems, so we have to build a new one. Unfortunately, the Linux version made it into a public repository, and some users installed it from there before we had a chance to remove it again.

  
  
  Thanks for clearing this issue.
• 

  redmondbFriday, June 28, 2013 7:35:35 PM

  Your "forced update" abomination would have been understandable twenty year ago, but in the dangerous place that is today's internet...? I am disgusted with the level of incompetence displayed by Opera.
• 

  Med1onFriday, June 28, 2013 8:37:56 PM

  "Opera plans to roll out a new version of its flagship browser which will use a new code signing certificate." (source: fudzilla.com)
  
  Really?
• 

  QuHnoFriday, June 28, 2013 9:16:19 PM

  Originally posted by webtax:

  for the people that want to delete opera link stuff

  I think Opera Link was in no way affected by this attack.
  
  

  Originally posted by Med1on:

  Really?

  Really!
  (PSSST! Secret first hand information retrieved from an Opera employee!
  DARN - he posted it several comments before! Scroll up!
  How could he do that to me! )
  

  Originally posted by tarquinwj:

  We received the new certificate on Monday, but due to technical issues, we were not able to ship an update as of yesterday, so we decided to release the details even without the update, rather than wait any longer.

  
  
  
  

  Originally posted by redmondb:

  Your "forced update" abomination (...)

  
  Most of the users of any software do not bother with updates, that's why in many countries up to 30% of all computers are infected with malware or part of a botnet.
  
  

  Originally posted by redmondb:

  I am disgusted with the level of incompetence displayed by Opera.

  
  Oh, really? 36 minutes to stop an attack is a very short response time. That doesn't look like incompetence to me.
  
  Consider the complexity of the Opera network and the millions of lines of code involved. Do you really believe, that any such complex human made system is free of bugs?
  If yes: Dream on!
  Or, to phrase it differently: Could you have stopped it in 36 minutes?
  If yes: Opera ASA probably would wants to hire you!
  
  
• 

  nev0Friday, June 28, 2013 10:04:09 PM

  Unfortunately, not all versions of Windows check the certificate, and some users may have disabled the UAC protection

  
  
  Please tell us WHICH versions of Windows check the certificate and whether that means those that do check are "safe" (or not).
  
  Seriously, this is totally unacceptable first off, and your post are so vague that all it does is make EVERY Windows Opera user nervous.
  
  Jesus Christ! Be more specific on *who* might be affected and whether a full system scan using any of the AV solutions that are listed on VirusTotal which can detect it will be able to fix the issue.
  
  Give us some freaking instructions on remedies etc. I've been an Opera user for years and I have to say, this is absolute bad news.
• 

  nev0Friday, June 28, 2013 10:13:21 PM

  Originally posted by QuHno:

  Oh, really? 36 minutes to stop an attack is a very short response time. That doesn't look like incompetence to me.
  
  Consider the complexity of the Opera network and the millions of lines of code involved. Do you really believe, that any such complex human made system is free of bugs?
  If yes: Dream on!
  Or, to phrase it differently: Could you have stopped it in 36 minutes?
  If yes: Opera ASA probably would wants to hire you!
  
  

  WTF are you on about, this shouldn't have happened on a properly secured network period with proper monitors and protocols. Yes networks can be secure despite what the media and other scaremongers may want you to believe. Shocking isn't it. Most secure networks are only compromised due to human errors via social engineering, but even if phishing attempts succeed, a proper corporation with strict and clearly defined access levels wouldn't have this sort of problem. So yes everybody has a completely reasonable claim to complain and be appalled.
• 

  QuHnoFriday, June 28, 2013 11:08:56 PM

  Originally posted by nev0:

  Yes networks can be secure despite what the media and other scaremongers may want you to believe.

  Networks that need access from outside of the internal net? Really?
  
  So Apache/NGIX/fooSQL/etc is error free and it is possible to secure a network as big as this to 100% and that you can eliminate human errors?
  
  I am aghast that I didn't know that!
  
  To rephrase the question a 3rd time:
  Are you able to secure that network so that it is 100% hack proof?
  If yes:
  Opera ASA will definitely want to hire you!
• 

  AraielSaturday, June 29, 2013 2:21:03 AM

  nev0, as far as I know, your questions are difficult to answer, unfortunately.
  
  If the automatic update server redirected users to a malicious site, how can anyone possibly know what the malicious site did (except the people controlling the malicious site, of course)? There are many possible things it could do.
  
  It could prompt the user to download and run a file that has a file name suggesting an Opera update and that stolen Opera signature. This would be easiest to avoid by just saying no. As far as I know, absolutely no version of Windows checks the certificates on executables _by default_ so that it will refuse to run a file that doesn't have valid signatures (valid meaning that the signature is correct, and is not expired or revoked) _if_ the user clicks ok to run it. It is possible that someone has a non-default system configuration, like with AppLocker, that could prevent such things, but those are very much not normal. But this situation is not the worst case scenario.
  
  The worst case would be that the malicious website doesn't just try to prompt a file download for the user to decide, but instead runs exploits against the user's browser (and plugins and etc). Then, if any of those exploits succeeds, it could gain the rights of the logged in user and do anything the user can. It could install malware of any kind depending on the user's privileges (admin or not), and do all kinds of evil things. There's no way to know which antivirus would pick up on any of it, because there's no way to know what malware is downloaded and installed. There could be rootkits for example which can be very difficult to detect, close to impossible in fact at least for most normal antivirus programs.
  
  So this is a nightmare scenario in my opinion. I don't have automatic updates enabled, ever, partially in fear of events like this, but if the browser.js update that can't be disabled in the GUI as far as I know connects to the same servers and could also have been redirected, it's pretty impossible for me to know if I got redirected to that malicious site or not. That is, unless I trust the statement by Opera that the malicious redirect was in place for only that reported short time. How much do I trust that statement? How much can I? So I feel that it's a matter of luck if I was infected by this thing or not, which is not a comfortable feeling. I know I wasn't online or even awake, computers off at the time Opera reports the problem existed. But I'm paranoid enough not to be able to trust that timeframe.
  
  There's not much more we can do than to make scans with our antiviruses (maybe even download a well respected additional antimalware tool like Malwarebytes), check our computers for strange changed behaviour and additional autostarts and things like that. If no problems found, that's better than finding problems, but it's no guarantee of safety.
• 

  redmondbSaturday, June 29, 2013 10:13:50 AM

  Originally posted by QuHno:

  Oh, really? 36 minutes to stop an attack is a very short response time. That doesn't look like incompetence to me.

  
  
  And this has what to do with "forced update"?
• 

  SerpherSaturday, June 29, 2013 5:48:29 PM

  And that's why I don't use automatic update feature... or Opera for that matter. I'll wait maybe a year for a "proper" Opera build not chrome clone as it is now.
• 

  redmondbSaturday, June 29, 2013 8:27:44 PM

  Originally posted by Serpher:

  And that's why I don't use automatic update feature

  
  Nor do I (a lesson I learned from a disastrous Opera upgrade many years ago). However, as I understand it, Opera users have no control over the Browser.js updates and they, apparently, were also a vector for malware.
  
• 

  funsoulbroSaturday, June 29, 2013 8:30:34 PM

  What a vague, spin-tastic article. And thanks for waiting an entire week before letting anyone know about it!
• 

  QuHnoSaturday, June 29, 2013 10:29:58 PM

  Originally posted by redmondb:

  Opera users have no control over the Browser.js updates and they, apparently, were also a vector for malware.

  
  when and how? They never got redirected afaik.
  
  Apart from that they are signed and do not work when altered you can deactivate all auto-updates in O<13 and download the browser.js manually from
  http://xml.opera.com/userjs/