My Opera Pages Used to Host Malware

Security researchers from antivirus vendor Kaspersky Lab warn that My Opera is being abused by hackers, after they found a botnet script hosted on its servers.

"There have been several reports about malware hosted on Mozilla and Google code servers. Now we also found malware hosted on My Opera community servers," Dmitry Bestuzhev, a Kaspersky Lab expert, writes on the company's blog.

My Opera is both a social network and support website for Opera users. The service has an estimated 5 million users and every account gets 2 GB of file storage.

As with many other free Web or file hosting services, this offers a place for cybercriminals to serve their malware from without having to pay for bandwidth.

Another reason why free hosting providers with millions of users are preferred, is because they are slow in responding to the large amount of abuse complaints.

According to Kaspersky's statistics, FileAve.com is currently the service hosting most malware (43%). It is followed by Ripway with 18% and RapidShare with 13%.

The rest of the top ten includes, in order, 110MB.com (10%), Freehostia (3%), FreeWebTown (3%), Justfree (3%), narod.yandex.ru (3%), 100Free.com (2%), and Freewebs (2%).

"I noticed that some secure DNS providers block access to the domains listed above and show an alert message stating that these sites are known sources of phishing and malware," the Bestuzhev says.

The malicious application found by the researcher on My Opera was a PHP-based IRC botnet client apparently created by Brazilian hackers.

My Opera is far from seeing the level of abuse other services do, but the incident might point to an increasing trend.

Back in July we reported about a spam campaign which abused the My Opera account activation email template.

The emails appeared exactly like the legit ones, but all links contained within directed users to a malicious website.