Skip navigation.

exploreopera

| Help

Sign up | Help

Opera Desktop Team

avatar

Malware protection

, , ,

If you're using the latest build, then browsing just got safer!

Since 2006, Opera has featured Fraud Protection, which protects you against phishing pages, and not too long ago we upgraded the backend part of it to provide even better protection using data from Netcraft, widely regarded as the best performing protector against phishing.

In collaboration with security experts Haute Secure we're now proud to announce the newest functionality to our Fraud Protection feature; Malware protection.

Everybody knows that there's more to watch out for on the Web than just phishing. Malware, in every imaginable shape and form, has exploded over the past few years. Viruses have been a problem for decades, and worms can in large part be blamed for the millions of spam messages people receive every day. But as the Web has evolved, so has its usefulness to crackers, and today malware on the Web is a major concern. Drive-by downloads using browser and plugin exploits are scary, and so is the creative social engineering that is used to make users download something innocent-looking, which in fact is malicious code that will harm your computer and/or steal your private information.

This is where malware protection comes in. While it is still important to maintain an up-to-date antivirus installed, Opera now offers an additional layer of protection, and will warn when you try to open a page that is known to contain malware, the same way it does when you try to access phishing sites.
Users already familiar with Haute Secure's popular anti-malware toolbar for other browsers already know how useful and important this is, and now, we have the same level of protection built directly into Opera, with a familiar interface.


Protection against malware will be enabled for everyone who has Fraud Protection enabled, and is live as of this post. If you would like to see it in action, grab the latest build and go to www.verybadsite.com to test it. We will soon be adding the ability for users to report new malware pages that are not yet detected, contributing to the "community watch" effect Haute Secure has been building since 2006.

Enjoy, and stay safe!

Looking SharpTurtle Wax

Comments

avatar
:up:

By Southern Cross, # 6. June 2008, 13:59:33

avatar
nice one!

By lamarca, # 6. June 2008, 14:13:46

avatar
Sweet.:sherlock:

By EricJH, # 6. June 2008, 14:16:22

avatar
That's great! :up:

By Morphdreamer, # 6. June 2008, 14:22:15

avatar
Great news! :smile:

By HellbillyDeluxe, # 6. June 2008, 15:03:09

avatar
Reporting of phishing sites doesn't require registration anymore :yes:

But is it going to always redirect to hautetest.com or such? I'd rather have original URL in the addressbar.

By porneL, # 6. June 2008, 15:05:13

avatar
Tell Haute Secure to update the "Download" menu :D
:wink:

By babox, # 6. June 2008, 15:12:19

avatar
i suggest two different warnings: one for fraud protection and the other for malware protection.

By lamarca, # 6. June 2008, 15:15:34

avatar
I thought that drive-by downloads were not possible with Opera? These warning are just to tell you that there's an unfixed vulnerability in the browser? Isn't this admitting that the browser IS insecure?

I thought that fixing vulnerabilies was priority #1 at Opera. I'm not so sure anymore...

Drive-by downloads using browser and plugin exploits are scary

Indeed. Do you admit such vulnerabilies are available in Opera? If not, then why would we need such "prevention" for something that is not supposed to exist? I understand protection about phishing, but this is not what this is about.

By Luchio, # 6. June 2008, 15:24:48

avatar
I've seen this type of page come up before, except instead of being about malicious software it's merely "fraudulent."

Here's what I'd like as options: An "Ignore forever" button -- "Ignore" somewhat misleadingly only holds for that session.

Also, a way to send a note to Netcraft/Haute Secure (whichever it is) disputing the status of the site.

By rseiler, # 6. June 2008, 15:28:00

avatar
:knight: hehehehehe

By emaia, # 6. June 2008, 15:42:15

avatar
@Luchio: I think it's more about the web pages that provide software that's meant to "fix Windows errors" and "improve Windows performance" for example. They're not vulnerabilities within Opera, but programs a user might download and run thinking it's genuine.

By AndrewNi, # 6. June 2008, 15:52:42

avatar
It shows
http://hautetest.com/opera/index.aspx
in the malware warning page instead of the
malicious site URL itself.
The example snapshot above shows
"http://verybadsite.com"
?

By arzafen, # 6. June 2008, 15:56:15

avatar
I have installed the best antivirus, it's name is Linux.

By juangiordana, # 6. June 2008, 15:57:39

avatar
porneL: Only the test page redirects to hautetest.com. If you encounter a real malware page, it will not redirect.

lamarca: The warning text for phishing and malware is different.

Luchio: Security in general is priority #1 at Opera. That not only includes fixing vulnerabilities (which we will certainly continue to do!), but also making sure to protect users who haven't yet upgraded, or when an exploit is so new that a security release isn't even available yet.
Exploits can happen with *any* software, Opera is no exception. While I don't know of drive-by downloads targeting Opera today, anything is possible. And please note that there's a difference between drive-by downloads using a security exploit, and drive-by downloads abusing a generally flawed security model.. :wink:

rseiler: The dispute option is already there, you can find it in the Page Info dialog. When you encounter a page that is bad, it will change to allow you to dispute a site.

By yitzhaq, # 6. June 2008, 15:59:38

avatar
iain from Haute Secure here. Great to see all the positive supoport from the Opera community - we're excited to be part of your community now and to help keep you safer on the web!

@Babox - because of the great partnership we have now with Opera, you don't even need to download anything from us to get our protection - it's built right into Opera 9.5. But your comment has made me realize we should call that out on our download page now - we should point people interested in Opera support straight to the Opera 9.5 download.

@porneL - we're still doing some final integration with the Opera team and i don't expect us to always be redirecting to hautetest.com (which is as you can probably guess, our test site)

@rseiler - we're working hard on integrating Opera into our existing process for disputing a site that has been incorrectly flagged. This is a really important feature for us because often the community is seriously fast at alerting us to these issues.


By iainmulholland, # 6. June 2008, 16:01:20

avatar
AndrewNi: We're the only browser that protects against that too :smile:

arzafen: The example snapshot has actually been photoshopped :whistle:
It was made before the test site went live. :smile:

By yitzhaq, # 6. June 2008, 16:02:21

avatar
simply Great!!!!

By morotatoi, # 6. June 2008, 16:44:42

avatar
devs, it seems that this week you've the perfect ingredients for Beta 3, this is tooooooo great and useful.

By andresruiz, # 6. June 2008, 16:45:19

avatar
Great work!!

By emperordarius, # 6. June 2008, 17:00:27

avatar

Originally posted by yitzhaq:

The dispute option is already there, you can find it in the Page Info dialog. When you encounter a page that is bad, it will change to allow you to dispute a site.

You mean "More info," as shown in your screenshot above? That doesn't show up on sites marked as "fraudulent." Note that if there was a permanent whitelist function, I wouldn't need to dispute it.

By rseiler, # 6. June 2008, 17:19:18

avatar
NICE, excellent decision! :yes:

One of my greatest wishes is heared! :cool:
(place 2 after forcing Micro$oft to put Operainto a standard
windows installation)

(one of mannnny wishes) :idea:
see here: http://my.opera.com/community/forums/topic.dml?id=195589
The "Saturday, 1. March 2008, 21:46:08, edited Sunday, 2. March 2008, 05:41:21" post :idea:


Edit: improvement:
Opera team, your warning sign should have
a VIRUS-symbol for Virusses/trojans, Backdoors/bots ... .
A Spy symbol for Spyware.
A AD symbol for adware.
A thief/steal-symbol for phishing... .

-> everyone (eaven illiterate) knows by the intuitive symbols
instant the kind of danger.

By masterofopera, # 6. June 2008, 17:19:26

avatar
It's already way too good.

It tries to ban my own homepage and all *.nm.ru with no way to change it.
Beeing even more restricted ? Would it make most used feature of Opera beeing disabing this protection ?

By the_Arioch, # 6. June 2008, 17:29:55

avatar
It tries to ban my own homepage and all *.nm.ru with no way to change it.
Can you post some examples of banned *.nm.ru URLs? Because I can't find any banned ones there.

By FataL, # 6. June 2008, 17:39:27

avatar

Originally posted by masterofopera:

Edit: Opera team, your warning sign should have a VIRUS-symbol, so
that everyone can see it at the first sight, that is a malware
catapult and no phishing page.
And when it is a phishing page: show something like
a "stealing/thief-icon)
-> everyone knows instant/ at the first sight
(eaven illiterate) the kind of danger.

+1
Devs, people doesn't read, people just want their funny content on web pages, so if you put that message, a lot of people wont mind of what is written there. example, take a teenager and put a fraudulent site bewteen that 16 y/o boy and a kind of sexual related content, even if you put that red message, he won't read, he will try to go to the site anyway so the warinng must be more graphical, people must get the idea in a fraction of a second. We're talking about security !
Be sure that the only text that teenager will read is: "ignore this warning"

By andresruiz, # 6. June 2008, 17:41:03

avatar
Thank you Opera for making your browser even more secure. I wonder what els is lined up that we don't know about ??

By John164, # 6. June 2008, 17:48:04

avatar

Originally posted by masterofopera:

Edit: improvement:
Opera team, your warning sign should have a VIRUS-symbol for Virusses/trojans, Backdoors/bots ... .
A Spy symbol for Spyware.
A AD symbol for adware.
A thief/steal-symbol for phishing... .


+1

Originally posted by andresruiz:

Be sure that the only text that teenager will read is: "ignore this warning"


Hey, don't stereotype! P:

By WOFall, # 6. June 2008, 18:42:54

avatar
A Spy symbol for Spyware.
A AD symbol for adware.
A thief/steal-symbol for phishing... .


Does it matter? It's all garbage. Just make sure the warning is clear that's a fault of the site, not browser error/communication error or virus infection that already happened.

By porneL, # 6. June 2008, 19:02:29

avatar
Luchio, +1

I hope Hautesecure does'nt use, like Mozilla do, Google's database to block "malicious site"...
Google seems to use unpatched Internet Explorer inside virtual Windows machine to detect malware sites (causing Drive by download) :wink:
http://research.google.com/archive/provos-2008a.pdf

Are Hautesecure black-lists more reliable and can really block specific Opera harmfull sites ?

Did Opera really need a such virtual security feature ?


By ra_mon, # 6. June 2008, 19:33:31

avatar

Originally posted by masterofopera:

NICE, excellent decision!

+1, excellent move!

By Darken, # 6. June 2008, 19:51:26

avatar
Awesome!

By kyleabaker, # 6. June 2008, 21:19:31

avatar

Originally posted by yitzhaq:

The warning text for phishing and malware is different.


i mean the warning box which prompts. they are similar. malware ........ phishing

By lamarca, # 6. June 2008, 21:30:44

avatar
WOOOOW, just when I still dont belive the work done in the latest builds, you bring this to the light .... You are amazing guys !!!

Keep up the good work, or how I say in spanish, SON GROSOS, SIGAN ASI !!!

I agree to do something prittier or less ugly for the warning prompts, perhaps something like Firefox 3 warning pages, but less Firefox too :jester:

NOTE::love:
While I was writing this, I found a bug in the password manager (wand). I had 2 different wand entrys for this page (sign in to write a comment). But I knew one of them was wrong, so I deleted the two of them, and then the colored edit box (enabled when a wand entry exist for this page) was still there, and I just have erased my two entrys.

I LOVE THE NEW SKIN AND I WOULD LOVE TO SEE IT MORE POLISHED:up:

By brunito_c, # 7. June 2008, 00:17:06

avatar
Here is an example of what I ment.

[img]http://img236.imageshack.us/img236/2906/dibujohy8.th.jpg

Free Image Hosting at www.ImageShack.us



I see the wand like if there were any password remembered, but there isnt any.

Hope this helps !:up:

UPDATE: I found that the mouse does not change while putting the cursor over a link/image, like the one I posted in here.

Other thing I would like to see is GMAIL 2.0 support !

Now I say good bye, and keep the great work you're doing !!!!

By brunito_c, # 7. June 2008, 00:26:15

avatar
Some advice for refinements:

"Ignore this warning" should be replaced by a button (could have continue on it although I'm not sure about that). The "go to homepage" button should be underneath it, and could have "close tab" written on it instead (those who like their homepage can have it when they open a new tab anyway). Better, because the user then dismisses the erroneous session and is discouraged from going "back" to the problem sites.

Finally, you should only see this once. Clicking Ignore/continue should then disable further warnings for the same site. A cascade of warnings (the current behaviour with verybadsite eg) will likely alienate users into pressing ignore repeatedly, defeating the whole object.

Just my 2p. Great feature for the average user tho, another first for Opera!

Seb :smile:

By sebt, # 7. June 2008, 02:39:21

avatar
Hi,

I think the new Malware Protection feature
in Opera is great. I was only commenting last
week about this feature being in Firefox 3.0
and was hoping Opera would implement it.
Are there any test sites where we can go to
see it in action besides the one listed above.


cheers
blinky

By blinkybill, # 7. June 2008, 03:01:24

avatar
firefox is coming sometime in June. We need to jump on it to catch up with them!

We may have the malware feature that they are offering, but that's not enough! we need more!
http://people.mozilla.com/~beltzner/overview-of-firefox3.swf

By kyleabaker, # 7. June 2008, 08:08:16

avatar

Originally posted by juangiordana:

I have installed the best antivirus, it's name is Linux

Amen, brother!

By pejakm, # 7. June 2008, 08:55:22

avatar

Originally posted by sebt:

"Ignore this warning" should be replaced by a button (could have continue on it although I'm not sure about that)
+1

By EricJH, # 7. June 2008, 13:09:48

avatar
Hello Iain of Haute Secure(HS),

Out of curiosity, how does the HS implementation within the Opera 9.5 beta compare with those of Internet Explorer and FireFox? Complete or partial functionality(soft sandbox, behavioral heuristics, behavior/process monitors)? Thanks in advance.


Peace & Gratitude,

CogitoErgoSum

By CogitoErgoSum, # 7. June 2008, 13:17:26

avatar
FataL> Can you post some examples of banned *.nm.ru URLs?

for example my one: http://arioch.nm.ru
Opera 9.27.8841/Win32 loads page, then instantly replaces it with opera:fraud-protection :-(

By the_Arioch, # 7. June 2008, 17:22:57

avatar
@the_Arioch: http://arioch.nm.ru opens for me in one of latest snapshots (10048), but it's not clean install.

By FataL, # 8. June 2008, 01:17:08

Write a comment

You must be logged in to write a comment. if you're not a registered member, please sign up.