Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I encountered a popup similar to this one this morning while checking the weather report at http://touch.woodtv.com/forecast in Safari, though I have not been able to reproduce it.

The title is "about://(null)" and the text "Why you no play Candy Crush!!" The popup occurred twice. I tapped Cancel both times.

I suspect the source of this is rogue JavaScript in an ad network, judging from the fact that the screenshot below shows it in an ad-supported application, and when I saw it, I was on an ad-supported website. My phone is not jailbroken.

I'm wondering if anyone is able to identify the source of the popup definitively. Speculation is running rampant on Apple's support communities and elsewhere, from push notifications (delete Facebook and all your games!) to carrier notifications (which don't work on iPod Touches…), and my gut tells me little of it is helpful. But I could also be very wrong.

(This is not my screenshot; it comes from https://discussions.apple.com/thread/5144627.)

Illustration of about://(null) popup

UPDATE 1: The Candy Crush people have this to say, but I'm not (yet) convinced there's actually something installed that is to blame: https://forums.king.com/forum/candy-crush-saga/bugs-known-issues-ccs/recent-spam-why-you-no-play-candy-crush/?entryId=2326

UPDATE 2: Just reproduced it in the iOS Simulator while clicking around woodtv.com, but I'm not sure how to track it down further from here.

enter image description here

share|improve this question
    
I'm having the same issue. I clicked cancel up until one point when I clicked OK (stupidly) to see if it would take me to an ad site or something. It didn't do anything. Didn't crash my app, nothing. I'm just afraid someone's finally created a virus for un-jailbroken iPods. –  user52560 Jul 3 '13 at 12:39
    
@Anon1 What app did you have open when you saw the popup? Was it an app with visible ads? –  zigg Jul 3 '13 at 12:45
    
Yes, I was using iFunny and FML also. People have mentioned other apps, too. I would assume it's just one of those annoying pop-up ads (which FML has) that just wasn't made correctly or something. Well, I'm hoping that's what it is, anyways. –  user52563 Jul 3 '13 at 12:55
    
@Anon1 See my latest update—I think that's exactly it. But I'm still looking into it and will write up an answer if I find out for certain. –  zigg Jul 3 '13 at 13:10
    
This popped-up on my I-touch while the Songza free app was running... –  user52569 Jul 3 '13 at 14:13

2 Answers 2

up vote 6 down vote accepted

Since I got the popup in iOS Simulator, I was able to use Safari's Develop menu to inspect the page. From there it was just an exercise in rooting around to find the obfuscated JavaScript, which, when run through jsbeautifier.org (which has the side effect of de-obfuscating it), looks like this:

var m = ['iphone', 'ipod', 'ipad', 'android'],
    u = navigator['userAgent']['toLowerCase']();
for (var d = 0; d < m['length']; d++) {
    if (u['indexOf'](m[d]) != -1) {
        if (confirm('Why you no play Candy Crush!!')) {
            window['top']['location'] = document['getElementById']('creative')['href'];
            break;
        };
    };
};

I think it's pretty safe to say that this is indeed a rogue ad, since on the page where I saw it, the ad itself was blank. It's trying to get you to click through to a link.

So, in other words, it's a real pain in the buttocks, but probably not actual malware. The ad in question is apparently delivered by AdMax by NEXAGE, so I'll see what I can do about alerting them.

share|improve this answer
1  
Great sleuthing. I agree that this is a simple website social engineering attempt and nothing more or less dangerous than the desktop advertisements that “Your Computer might be at Risk!” as the first step to getting people to go click on buttons hoping to execute code to compromise their computers. –  bmike Jul 3 '13 at 13:31

Initially I felt this was a faulty ad from the website.

I looked on an Apple forum (a link here would be ideal) about when the popup started saying that the app they were using (some sodoku game) started lagging and the popup came up. When they clicked cancel, it popped up again, and when they clicked OK, they were redirected to the App Store, but didn't let the page load. They're worried that it's malware but now I'm even more convinced its just a faulty ad.

share|improve this answer

protected by Community Jul 3 '13 at 14:48

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.