5

Lately I occasionally get redirected to other websites when I load some news websites. It could be a banner redirect I guess, but I suspect something more sinister.

The iPad is NOT jailbroken and runs the latest iOS 5

Last three incidents were

I can only imagine both situations were safari or embedded safari, but I do not know how the official twitter app loads web pages into its own pane

Googling for malware on iPad has so far turned up nothing.

Suggestions? I can of course revert to factory default, but it would be useful to know what I had encountered.

Looking at the dsn settings, they start with 10. so local to my network - none of my other devices (iPad3, iPhone4/4S, iMac, macBook (yes, I'm a fanboy) ) on the same network shows this behaviour.

For now I have cleared cookies and application data. I will try to reproduce.

Improve this question
7
  • 1
    Did you check the DNS/name server in the Network settings?
    – nohillside ♦
    Jun 18, 2012 at 9:17
  • No - that sounds ominous... Some app could change that?
    – mplungjan
    Jun 18, 2012 at 9:18
  • I don't know but if you really suspect malware I wouldn't rule anything out.
    – nohillside ♦
    Jun 18, 2012 at 9:22
  • I will check that out when I get home. Thanks for the suggestion
    – mplungjan
    Jun 18, 2012 at 9:30
  • 1
    See update. It happens after load of some websites. Possibly an ad server has been hacked or something
    – mplungjan
    Jul 5, 2012 at 11:28

5 Answers 5

Reset to default
4

I have not heard of any exploit that would produce this behaviour.

The fact that the pages DO load, and only switch to another page AFTER they have loaded, indicates to me that the problem lies within the page itself. For instance some "evil" Javascript is inserted into the page causing it to redirect.

If the problem was in the OS, for instance messing with DNS, I would expect that you would never be able to reach the page and you would immediately be getting the "evil" page.

Ad networks have often been used for this kind of abuse because there are many parties providing content for ads, so it is hard to check everything that goes on. I would think that an evil advertisement is much more likely to be the cause of this problem than any malware on your iOS device.

You could try using your iPad via proxy and monitor the traffic that comes through. You could set your computer to share its internet connection over Wifi, and run a html proxy on your computer. And then look in the transferred code to see if you can identify the cause of the redirects.

Improve this answer
4
  • Right... Setting up a proxy is a bit over the top. I was more looking for a fix to a known exploit - like inserting some greasemonkey-like script/plugin into my safari.
    – mplungjan
    Jun 19, 2012 at 16:20
  • I just happen to have a stepbystep article on burb so I will give it a try
    – mplungjan
    Jun 26, 2012 at 5:18
  • @mplungjan So, what happened? It would be nice if you let us know what was causing this behavior.
    – gentmatt
    Jun 29, 2012 at 16:39
  • I did not get a chance to test - I will not be able to test until mid August the earliest :( sorry. I still have the problem where I am now
    – mplungjan
    Jul 5, 2012 at 11:25
4

If your device is not jailbroken the odds of malware on iOS are basically 0, at least for what you're describing. There is currently no way anything could be installed without going through the App Store. Even then, a malicious app could only access its own files in its own sandbox. So, no installed app on iOS could modify anything outside of it.

This is also why you won't find any app scanning your iPad for malware. A malware scanner would need access to all system files but no app on iOS could do that (except for Apple's own apps).

This sounds more like a problem made by the particular websites themselves.

Improve this answer
2
  • As I said, nothing on iOS can modify system settings except Settings.app itself. Mobile Safari allows no plugins. If you visited the within the twitter app, then it's not Safari.app but only a UIWebView. This is even more restricted than Safari. So there's nothing to scan for and no app would be allowed to have such functionality.
    – kremalicious
    Jun 18, 2012 at 15:04
  • 2
    " So what do you suggest? Spitsnieuws.nl and Forbes.com both serving porn redirects? I have a hard time believing that. – mplungjan " the company name/website alone is NOT a security feature
    – user24153
    Jun 18, 2012 at 17:47
2

Sure sounds like something with the target websites. You could install Wireshark on a laptop with wi-fi, monitor your traffic when you visit the site and see what happens. You could then do the same from another (working) machine and see if the same HTTP messages are sent/received.

Also, now that Chrome is out on the iPad, you could try that to see if it behaves differently.

Improve this answer
0

If a malware want to infect in you iPad from Safari, it need a exploit from Safari, if a exploit like that was found and they post it on the news, Apple will fix it to avoid Jailbreak ASAP. So if you running latest iOS and not jailbroken so no need to worry.

Improve this answer
6
  • 1
    Except my iPad is behaving weirdly so I AM worried.
    – mplungjan
    Jun 19, 2012 at 6:06
  • Also it would not be the first time I was the first to see an exploit on a computer. Never had a virus but did receive some new ones in the mail. To get adware you do not need to exploit the browser. Just intercept the requests or the replies
    – mplungjan
    Jun 19, 2012 at 6:17
  • @mplungjan I'm really not sure what you want us all to say. Multiple people pointed out you can't "scan" for malware on the iPad except checking your Settings. Your question has been answered multiple times. Just waiting for a confirmation of your theories isn't going to work. If you have read all the answers why are you still starting unproven theories like "to get adware you do not need to exploit the browser"? I repeat: this is technically not possible on the iPad, how iOS works is fundamentally different from all your other computers. Everyone here pointed this out already.
    – kremalicious
    Jun 23, 2012 at 13:20
  • So what happened on my iPad then?
    – mplungjan
    Jun 26, 2012 at 4:58
  • Is it still occurring? If not, then that is another pointer that the source is outside your iPad. If the problem was on those websites or on an ad network they all used, I would expect it to be found and solved by now.
    – Michael van der Griendt
    Jun 26, 2012 at 8:48
0

Are you travelling in Spain when the redirect happens? If so, I'm seeing it here as well and I believe it is the ad serving network serving a geographic ad from Spain (perhaps other countries too) that is redirecting to the porn ads.

Improve this answer
1
  • 1
    No. I am in holland. I just find it unacceptable that a newspaper and a site like Forbes allow such spam since it replaces the article I am looking at
    – mplungjan
    Aug 7, 2012 at 15:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .