Google in iPhone/iPad Safari is hijacked/redirecting. Help Please...

Question

Google in iPhone/iPad Safari is hijacked/redirecting. Help Please...

Starting just today, completely out of nowhere, both iphones in my home (two 3GS models) and both iPads (a first gen and a third gen) have problems with Google searches.

If you type in any search phrase in the Google search box, I get a 404 Not Found page.

And if type in www.google.com, it redirects to www.bd2c02ed.qqc.co, which is some weird "linkbucks" site.

My Macbook laptop on the same wireless network is not affected so I don't think it's an issue with my router, DNS settings, ISP, or anything else like that.

I've seen this same type of virus/issue on desktops and it looks like there are solutions to fix it. However, I haven't seen any fixes for the iphone and ipad.

Any help is greatly appreciated!

Posted on Jun 12, 2012 6:27 AM

Reply

Answer 1

Jun 12, 2012 12:54 PM in response to GrannySmith007

I have exacly the same problem on my Mac. It is mainly affecting youtube with me but has done it once or twice when I've been trying to go on Google. I don't think it is affecting just Macs, iPhones or iPads either as my brother with his windows computer had the same trouble yesterday and he doesn't even use Safari.

Reply

Answer 2

Jun 12, 2012 1:06 PM in response to GrannySmith007

Does it happen when you are using cellular data?

Reply

Answer 3

Jun 12, 2012 2:18 PM in response to GrannySmith007

Interesting question regarding cellular vs. wi-fi. I turned off the wi-fi on my iphone and the problem is gone. After turing the wi-fi back on, I am able to go to google.com without the redirect, but if I use the default google search box in safari, I still am getting the 404 Not Found error page. If I set the default search box to yahoo or bing, the search box then works.

So, I guess the problem is now:

1. when I'm using wi-fi

2. when I'm using the google search box as the default setting in safari

3. only with my ipad and iphone, not my laptop (which is on the same home wireless network)

I guess my problem is mostly solved, but it still bothers me that someone/something is clearly on my iphone and ipad causing this to error to happen when using the google search box. It makes me wonder if something else is going on that I'm not aware of. So, I'd still like to get this fixed fully.

Reply

Answer 4

Jun 12, 2012 2:26 PM in response to GrannySmith007

It sounds like the DNS address that your router assigns to the phone is wrong. It isn't affecting your laptop because it hasn't updated its IP address recently, and thus hasn't gotten the bad DNS address. But your phone and iPad request a new IP address with every connection. If you power cycle the router you can probably force the same error into the laptop, or possibly cure the problem for all devices.

The open question, if this is the problem, is how the DNS got corrupted in the router. There are computer viruses that alter the DNS address in the computer, but I haven't seen any that update the router's DNS. And there are none for iDevices, at least not yet.

Reply

Answer 5

Jun 12, 2012 4:34 PM in response to GrannySmith007

Thanks. I have a home aquarium monitoring system on my home network that's basically a little web server. Because of this, I use a static IP address and fixed DNS server addresses in the router. Maybe there's an error somewhere in the router settings?

The problem didn't start until my Netgear router died and I had to replace it a few days ago. Maybe the new router settings don't 100% match my old ones??

Reply

Answer 6

Jun 12, 2012 4:42 PM in response to GrannySmith007

That's likely. The DNS server address is probably wrong. You might want to use OpenDNS (208.67.222.222, 208.67.220.220) or Google's (8.8.8.8, 8.8.4.4) unless your ISP has a custom DNS that maps to its internal server addresses.

Reply

Answer 7

Jun 12, 2012 4:46 PM in response to GrannySmith007

Thanks again! I don't know too much about this stuff. I use DYN DNS with the aquarium system. Can I use those DNS addresses you suggested? Or does the DNS service I use dicatate the address that will work?

Reply

Answer 8

Jun 12, 2012 4:56 PM in response to GrannySmith007

You can use any public DNS. But you need dyndns for your aquarium system. I'm not sure if they provide public DNS also; you may need to include both a public DNS and dyndns in the DNS server list.

Reply

Answer 9

GZukes

Level 4

1,584 points

Jun 12, 2012 5:06 PM in response to Lawrence Finch

Dyndns redirects a fixed URL to a dynamic IP address, and as far as I know does not provide public DNS.

Reply

Answer 10

Jun 12, 2012 5:27 PM in response to GrannySmith007

Thanks for the two above posts. I will check with DYN and the monitoring system manufacturer to see if they know what the deal is since you've helped me narrow it down to a possible problem and solution....

Reply

Answer 11

Jun 13, 2012 9:59 AM in response to GrannySmith007

I just fixed this problem, it is a DNS hack of your router. Mine was Netgear. They set the router to static IP and changed DNS servers.

Fix: Log into router, hopefully they did not change the default password (they didnt on mine) and reset setting and set strong password. Also disable remote management. They also disabled the DDOS protection and port scanning protection.

Please post the IP address and DNS address they changed you to, I changed mine before I wrote them down 😟

Also if you are using dyndns you probably will just need to set it to DHCP on both IP and DNS

You can also confirm this by it only being at your house, if you connect to another wifi connection you will have no problems. Similarly if someone brings a new device to your house and your router issues it a IP it will also get the redirect to "http://bd2c02ed.qqc.co/" (123.49.43.156)

Seems to be "google" IP's. Mine did it for youtube.com and google.com

Also do you use and PC's on your network or have there been any connected recently? I am interested to see if this orginated on the Mac either iOS or OSX or on the Windows side?

I would reccommend even doing a factory default on the router and changing any passwords that could get sniffed off your network. I dont see anything of that sort on my end but better to be safe then sorry. Also keep an eye on any online banking or anything like that.

Reply

Answer 12

Jun 13, 2012 10:13 AM in response to Fraser_Hudson

See my post above

Reply

Answer 13

Jun 15, 2012 7:16 AM in response to GrannySmith007

I switched my DNS server addresses (which were and are fixed) to google's public ones. Problem fixed.

Reply

Answer 14

Jun 15, 2012 7:44 AM in response to GrannySmith007

Great! Glad it's resolved.

Reply