Alerts E-Threats

Opera Users Exposed to BlackHole through Browser Homepage

Opera-Users-Exposed-to-BlackHole-through-Browser-Homepage-2

For at least the last few hours, Opera users have been exposed to e-threats coming from the notorious BlackHole exploit pack.

Earlier today, the Bitdefender automated scan systems alerted us to the fact that a malicious obfuscated script loaded by hxxp://portal.opera.com address redirects users towards a malicious page hosting the notorious BlackHole exploit. Apparently, the script has been loaded through third-party advertisement, a practice commonly known as malvertising. You probably remember the recent incident with Yahoo Messenger hijacking the browser start page to a Vietnamese Portal.

The hidden and obfuscated piece of code in the Opera Portal homepage inserts an IFrame that loads malicious content from an external source. If the Opera user hasn’t changed the default homepage, active malicious content is loaded from a third-party website (g[removed]750.com/in.cgi) whenever they open their browser.

Fig. 1. Bitdefender detects malware the moment Opera Portal homepage is loaded

This malicious page harbors the BlackHole exploit kit (we got served with the sample via a PDF file rigged with the CVE-2010-0188 exploit) that will infect the unlucky user with a freshly-compiled variant of ZBot, detected by Bitdefender as Trojan.Zbot.HXT. The ZBot malware is on a server in Russia which, most probably, has also fallen victim to a hacking attack, allowing unauthorized access via FTP.

Bitdefender detects the obfuscated script as Trojan.Script.478548; the offending page loaded by the Opera Portal was also blocked since the emergence of the attack via the cloud URL blocker.

If you have any doubts about whether you have fallen victim to this stunt, you should run a 60-second QuickScan available on the Bitdefender Quickscan website.

This article is based on the technical information provided courtesy of Cristina Vatamanu and Razvan Benchea, Bitdefender Virus Analysts.

About the author

Loredana BOTEZATU

A blend of teacher and technical journalist with a pinch of e-threat analysis, Loredana Botezatu writes mostly about malware and spam. She believes that most errors happen between the keyboard and the chair. Loredana has been writing about the IT world and e-security for well over five years and has made a personal goal out of educating computer users about the ins and outs of the cybercrime ecosystem.

12 Comments

Click here to post a comment

Your email address will not be published. Required fields are marked *