“On June 19th we uncovered, halted and contained a targeted attack on our internal network infrastructure. Our systems have been cleaned and there is no evidence of any user data being compromised. We are working with the relevant authorities to investigate its source and any potential further extent. We will let you know if there are any developments.
The current evidence suggests a limited impact. The attackers were able to obtain at least one old and expired Opera code signing certificate, which they have used to sign some malware. This has allowed them to distribute malicious software which incorrectly appears to have been published by Opera Software, or appears to be the Opera browser.
It is possible that a few thousand Windows users, who were using Opera between 01.00 and 01.36 UTC on June 19th, may automatically have received and installed the malicious software. To be on the safe side, we will roll out a new version of Opera which will use a new code signing certificate.”
Blog Naked Securitymenilai tulisan dengan judul Security breach stoppedyang dipos perusahaan tidak benar, karena mencurigai bahwa adanya jaringan yang dibobol, code-signing yang dicuri, malware yang disusupi, file yang telah diinfeksi dan berada di server Opera yang mungkin telah diunduh dan di-install sendiri oleh Opera.
Naked Security juga mempertanyakan bahwa, bukankah prosedur auto-update Opera sudah gagal dan seharusnya memberikan peringatan mengenai certificate yang sudah kadaluarsa?
Hingga Opera menjawab pertanyaan tersebut, pengguna Windowsyang memanfaatkan Operaseharusnya berasumsi untuk kejadian yang paling buruk. Namun, kabar baik yang perlu juga diketahui,malwaretersebut dapat dideteksi oleh anti virus.
Bagi pengguna sendiri disarankan untuk mengunduh Opera versi terbaru, memastikan anti virus aktif, serta melakukan scanning komputer.
Sumber: Ciso