2

I opened an internet radio app, HiDef Radio, that I have used before, many times, on my iPhone 4s with iOS 9.3. After connecting to a station and listening a short while, a window popped open saying:

Apple Security
Attention!!

(6) virus detected on your iPhone!
IP address 108.72.0.216 (not my iPhone's IP address)
One of the last sites you've visited contained a Trojan, loading via the vulnerabilities of the browser.

Click ok to start the cleaning process. After clean up, make sure to upgrade your system to the latest version.

Install Cancel

Detected by Apple Firewall Ver 6.2.7

Clicking the Cancel button took my to the App Store for a VPN program, HotSpot Shield Free VPN Proxy which, as it turns out, I already have on my iPhone! But it was not running (and is not now, either) when the popup window appeared.

So what does all this mean? Obviously the popup is fake, there is no Firewall on iOS, the IP address is wrong, etc.

Is AnchorFree (makers of HotSpot) resorting to scare tactics to push their product?
Is the HiDef Radio app compromised?

Improve this question
6
  • Not sure what compromised means to you K Prosser. It seems very plausible HiDef radio app cedes control of the ui to sponsors and may have not vetted or cared what scare-ware or scam-ware it pushes.
    – bmike ♦
    Jul 10, 2017 at 10:20
  • To me, "compromised" means "hacked" or, as you suggest, "ceding control while abandoning one's moral responsibilities to one's users." I really like your idea about ceding control and not caring. Hadn't occurred to me at all! I have emailed HDR's authors and asked abut this. I will update this when (and if) I get a reply.
    – user245754
    Jul 10, 2017 at 19:10
  • Well, I contacted the HiDef Radio folks and have not received an answer. Probably too embarrassed to reply. I'd as AnchorFree, but I would bet their response would be the same. I have deleted the HotSpot Shield app and have not seen that "scare" screen again when using HDR.
    – user245754
    Jul 18, 2017 at 0:22
  • This just popped up on my iPhone with a different IP address, also not mine. I hit my home button twice and closed all apps. Curious to see if anyone has seen this 'warning' return.
    – BetteBoop57
    Jul 27, 2017 at 2:26
  • 1
    A screenshot would be helpful. The way the popup appears/looks is far more revealing than just its contents.
    – user11633
    Jul 27, 2017 at 20:56

4 Answers 4

Reset to default
1

These popups are completely and totally FAKE. All they're meant to do is prey upon your fears as a user. (tl;dr at the bottom)

Most app advertisements are networked, meaning the developer adds a little bit of code to their app, sets what kind of ads they want, and the network lets people buy ad slots. Sketchy ads (like these) pay a lot more, since they're banned from many networks and only some apps allow them (that's usually configurable).

These app advertisements are usually implemented as a custom WebView that only closes once the X appears after a few seconds. As you can see here, these ads also appear in safari, where you have to close the page, and cancel can do whatever the designers want it to do:

fake virus popup

A lot of this style of ad also reference the "adult sites you've visited" hoping you won't turn to technical support or the Internet for help.

In reference to you saying that this was made by AnchorFree, that's highly likely. It's an easy (and sadly, effective) way of pushing their product to get more subscribers. Clicking download would've most likely taken you to the HotspotShield install page as well. Your HiDef radio app is probably fine.

tl;dr: your phone is fine, the ad is fake, and AnchorFree probably paid for it. The HiDef radio app is also fine.

PS: I'd be careful about the VPN apps you use, since some will sell your data that they gather through the tunnel they make to advertisers and other people. Read the privacy policy!

Improve this answer
2
  • I had the same issue. It was showed this alert. I clicked on "cancel" button and did not install anything the were recommending. Should I do something else to make sure I'm not infected?
    – Mariana Meinberg
    Jul 30, 2017 at 2:25
  • @Mariana - it is highly improbable that your phone has malware on it. The only real ways to do that is downloading apps that aren’t on the app store. Even then, the risk is minimal due to iOS’ restrictions.
    – jacksonwelsh
    Jul 30, 2017 at 2:54
-1

No, more likely the "Free VPN" app is a trojan. Remove it.

Improve this answer
0
-1

I received this identical (except IP is different) pop up today on iPhone 6 (iOS 10.3.2).

I do not have HiDef Radio or FreeVPN installed (nor have I ever visited HiDefRadio site).

I my case, it seems to be related to Words with Friends app.

I did NOT click "Install". Note: clicking "Cancel" did NOT take me to App Store. It just closed the pop up.

Several other sites discuss how to remove it (this pop up)

Improve this answer
3
  • Is it worth linking to the other sites or are they not helpful?
    – bmike ♦
    Jul 27, 2017 at 21:16
  • I hate giving out links because you don't know if I'm a s hacker, but if you google the message you get, you'll find them
    – Tom
    Jul 27, 2017 at 22:26
  • Fair enough. Thanks had +1 from me. Also, belated Welcome to Ask Different.
    – bmike ♦
    Jul 27, 2017 at 22:30
-2

I had the same problem with one of our iPhone users and I'd recommend restoring the phone to factory but before doing that review what apps you have installed.

Fake security alert

Improve this answer
1
  • That’s a web page trying to scare someone. Bad people made it of course, but it’s more like an untruthful newspaper flyer or direct mail piece. It’s not exploiting the system, just your trust.
    – bmike ♦
    Dec 15, 2017 at 21:40

You must log in to answer this question.