Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Lately I occasionally get redirected to other websites when I load some news websites. It could be a banner redirect I guess, but I suspect something more sinister.

The iPad is NOT jailbroken and runs the latest iOS 5

Last three incidents were

I can only imagine both situations were safari or embedded safari, but I do not know how the official twitter app loads web pages into its own pane

Googling for malware on iPad has so far turned up nothing.

Suggestions? I can of course revert to factory default, but it would be useful to know what I had encountered.

Looking at the dsn settings, they start with 10. so local to my network - none of my other devices (iPad3, iPhone4/4S, iMac, macBook (yes, I'm a fanboy) ) on the same network shows this behaviour.

For now I have cleared cookies and application data. I will try to reproduce.

share|improve this question
1  
Did you check the DNS/name server in the Network settings? –  patrix Jun 18 '12 at 9:17
    
No - that sounds ominous... Some app could change that? –  mplungjan Jun 18 '12 at 9:18
    
I don't know but if you really suspect malware I wouldn't rule anything out. –  patrix Jun 18 '12 at 9:22
    
I will check that out when I get home. Thanks for the suggestion –  mplungjan Jun 18 '12 at 9:30
1  
See update. It happens after load of some websites. Possibly an ad server has been hacked or something –  mplungjan Jul 5 '12 at 11:28
show 2 more comments

5 Answers 5

up vote 3 down vote accepted

I have not heard of any exploit that would produce this behaviour.

The fact that the pages DO load, and only switch to another page AFTER they have loaded, indicates to me that the problem lies within the page itself. For instance some "evil" Javascript is inserted into the page causing it to redirect.

If the problem was in the OS, for instance messing with DNS, I would expect that you would never be able to reach the page and you would immediately be getting the "evil" page.

Ad networks have often been used for this kind of abuse because there are many parties providing content for ads, so it is hard to check everything that goes on. I would think that an evil advertisement is much more likely to be the cause of this problem than any malware on your iOS device.

You could try using your iPad via proxy and monitor the traffic that comes through. You could set your computer to share its internet connection over Wifi, and run a html proxy on your computer. And then look in the transferred code to see if you can identify the cause of the redirects.

share|improve this answer
    
Right... Setting up a proxy is a bit over the top. I was more looking for a fix to a known exploit - like inserting some greasemonkey-like script/plugin into my safari. –  mplungjan Jun 19 '12 at 16:20
    
I just happen to have a stepbystep article on burb so I will give it a try –  mplungjan Jun 26 '12 at 5:18
    
@mplungjan So, what happened? It would be nice if you let us know what was causing this behavior. –  gentmatt Jun 29 '12 at 16:39
    
I did not get a chance to test - I will not be able to test until mid August the earliest :( sorry. I still have the problem where I am now –  mplungjan Jul 5 '12 at 11:25
add comment

If your device is not jailbroken the odds of malware on iOS are basically 0, at least for what you're describing. There is currently no way anything could be installed without going through the App Store. Even then, a malicious app could only access its own files in its own sandbox. So, no installed app on iOS could modify anything outside of it.

This is also why you won't find any app scanning your iPad for malware. A malware scanner would need access to all system files but no app on iOS could do that (except for Apple's own apps).

This sounds more like a problem made by the particular websites themselves.

share|improve this answer
    
As I said, nothing on iOS can modify system settings except Settings.app itself. Mobile Safari allows no plugins. If you visited the within the twitter app, then it's not Safari.app but only a UIWebView. This is even more restricted than Safari. So there's nothing to scan for and no app would be allowed to have such functionality. –  kremalicious Jun 18 '12 at 15:04
2  
" So what do you suggest? Spitsnieuws.nl and Forbes.com both serving porn redirects? I have a hard time believing that. – mplungjan " the company name/website alone is NOT a security feature –  user24153 Jun 18 '12 at 17:47
add comment

Sure sounds like something with the target websites. You could install Wireshark on a laptop with wi-fi, monitor your traffic when you visit the site and see what happens. You could then do the same from another (working) machine and see if the same HTTP messages are sent/received.

Also, now that Chrome is out on the iPad, you could try that to see if it behaves differently.

share|improve this answer
add comment

Are you travelling in Spain when the redirect happens? If so, I'm seeing it here as well and I believe it is the ad serving network serving a geographic ad from Spain (perhaps other countries too) that is redirecting to the porn ads.

share|improve this answer
1  
No. I am in holland. I just find it unacceptable that a newspaper and a site like Forbes allow such spam since it replaces the article I am looking at –  mplungjan Aug 7 '12 at 15:20
add comment

If a malware want to infect in you iPad from Safari, it need a exploit from Safari, if a exploit like that was found and they post it on the news, Apple will fix it to avoid Jailbreak ASAP. So if you running latest iOS and not jailbroken so no need to worry.

share|improve this answer
1  
Except my iPad is behaving weirdly so I AM worried. –  mplungjan Jun 19 '12 at 6:06
    
Also it would not be the first time I was the first to see an exploit on a computer. Never had a virus but did receive some new ones in the mail. To get adware you do not need to exploit the browser. Just intercept the requests or the replies –  mplungjan Jun 19 '12 at 6:17
    
@mplungjan I'm really not sure what you want us all to say. Multiple people pointed out you can't "scan" for malware on the iPad except checking your Settings. Your question has been answered multiple times. Just waiting for a confirmation of your theories isn't going to work. If you have read all the answers why are you still starting unproven theories like "to get adware you do not need to exploit the browser"? I repeat: this is technically not possible on the iPad, how iOS works is fundamentally different from all your other computers. Everyone here pointed this out already. –  kremalicious Jun 23 '12 at 13:20
    
So what happened on my iPad then? –  mplungjan Jun 26 '12 at 4:58
    
Is it still occurring? If not, then that is another pointer that the source is outside your iPad. If the problem was on those websites or on an ad network they all used, I would expect it to be found and solved by now. –  Michael van der Griendt Jun 26 '12 at 8:48
show 1 more comment

protected by Community Sep 23 '12 at 6:33

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.