Pornographic Images popping up on iPhone

Red_Sqwiwul wrote:

Looking at other forums a factory reset does not solve the problem.

The question is did the user revisit the sites that caused it in the first place? If they did then the problem would re-appear.

In my experience I saw the problem after visiting adult sites. After wiping the iPhone and no longer visiting adult sites I never saw the problem again.

Mark my words, the only resolution is to wipe the phone and never visit those gambling sites again - keep that for your desktop/laptop. Until Apple admits that it's malware and provides a way to remove it, you haven't really got many other options.

A web site can auto refresh and during that refresh cause another site to load. Sites that do such activity have been compromised or you are visiting less than honorable sites. The phone is not infected, the phone is not compromised, it is the web site you are visiting. Don't visit that website again.

Until Apple admits that it's malware and provides a way to remove it, you haven't really got many other options.

Why would they admit to that when it isn't true? When your sandwich goes missing while camping in the woods, it's not Bigfoot that took it. The same holds true with malware on iOS. If countless security researchers haven't turned up any malware for iOS yet, do you really think it's not only out there, but as easy as you claim to find?

So, what we know: you and a friend have had this happen on three different devices, on three different sites, while on two different networks (provided by two different companies).

This doesn't necessarily rule out the network, though. First, are you sure that you weren't both using cellular data with the same provider at the time that it happened? If you both were using cellular data from the same cellular provider, their network could have been compromised.

Second, is it possbile that those two ISPs are using the same domain name servers for some reason? To check the latter, go to Settings -> Wi-Fi, tap the 'i' icon next to the selected network and look at the DNS setting. If that number starts with 10.0 or 192.168, then the DNS setting needs to be looked up on the wireless router. Find those numbers instead. Compare... if you and your friend happen to both be using the same DNS server, a poisoned DNS server could be the issue.

Also, I'm assuming these are home or work networks, and not free wifi from some coffee shop or somewhere. Such places have been known to inject code for their own ads into the HTML for every page downloaded. If you are both using such a network, that could be the issue.

Alternately, this could be a problem with hacking of the sites involved, or an ad server used by all the sites involved. This is less likely to be the issue in your case, since it happened once on Twitter. Unless you had another page with ads loaded on another tab, and that page cycled to an ad that caused that pop-up.

I also notice that you haven't said whether or not these devices are jailbroken. If they are, anything's possible. If you didn't jailbreak it, might someone you know have done so as a prank? Search your iPhone for the Cydia app... if it's there, someone has jailbroken your phone.

raymond73 wrote:

A web site can auto refresh and during that refresh cause another site to load. Sites that do such activity have been compromised or you are visiting less than honorable sites. The phone is not infected, the phone is not compromised, it is the web site you are visiting. Don't visit that website again.

You can visit the "less than honourable site", inadvertently inherit the issue, close the browser, clear the cache, delete cookies and then relaunch Safari and browse "honourable" sites and the problem will still occur.

Thomas A Reed wrote:

When your sandwich goes missing while camping in the woods, it's not Bigfoot that took it.

Erm, yeah not really getting the link with your Bigfoot analogy but at least it was condescending so thanks for that.

Look, I'm making an assumption yes, but it's based on the facts that I know. This isn't a cookie because it happens after you have deleted them but before you visit the offending sites again. It isn't the wi-fi network because it doesn't return if you wipe the device and do not visit the offending sites again. The cellular network? The DNS servers of the ISP? I think you're reaching there. Public wi-fi or Jailbroken device? Not the case for me. Keep trying though - it's appreciated and we all get to see how smart you are.

Here's the resolution: wipe the device and do not revisit offending sites

PS. Who'd of thought that by browsing adult sites on my iPhone I would be in the minority? 🙂

Message was edited by: heligo9

Meg St._Clair wrote:

Red_Sqwiwul, if you're still here, ignore the back and forth. Pay attention to Thomas. He is our resident expert on the matter and highly trustworthy.

I'm not trying to pick a fight. I'm just sharing my experience to try and help the OP. But Thomas is the resident expert (who's clearly very clever and seemingly very funny) so we should listen to him.

Don't worry I'll get my coat. I can tell when I'm not welcome 🙂

heligo9 wrote:

Meg St._Clair wrote:

Red_Sqwiwul, if you're still here, ignore the back and forth. Pay attention to Thomas. He is our resident expert on the matter and highly trustworthy.

I'm not trying to pick a fight. I'm just sharing my experience to try and help the OP. But Thomas is the resident expert (who's clearly very clever and seemingly very funny) so we should listen to him.

Don't worry I'll get my coat. I can tell when I'm not welcome 🙂

Yes, he is the expert. Seriously. It is why the majority of us that have been here a while defer to his advice when it comes to malware on Apple devices (or any device for that matter).

And yes, he is clever and sometimes funny.

You can choose to stick around, and possibly learn something from him, or not. Obviously your choice.

Blaming Bigfoot for nabbing a sandwich is about the same as blaming malware for... well, anything, really... on iOS. It was meant to be an amusing, yet totally accurate, analogy, and nothing more. If you choose to find it insulting, that's not my issue.

I don't know what happened with your particular phone. There are many possibilities. Unless your phone was jailbroken, or wasn't actually an iPhone, malware wasn't the cause. It's difficult to troubleshoot these things over a written medium, without being able to see it, and doubly so when the problem has gone away. My suspicion, though, is that the resolution of your problems has more to do with not visiting those adult sites anymore, and less on restoring the phone.

Regarding things like DNS poisoning or ad injection, these kinds of things do happen, and are most often mistaken for malware. You scoff, but I've seen it happen.

In any case, as others have indicated, I do a lot of research on this topic. Check out my site if you're interested:

http://www.thesafemac.com/

I'm certainly not all-knowing or infallible. However, I spend a fair bit of time loading pages that most people would be well-advised to stay away from. I often will open those sites on my iPad, which I know is safe. I've never had a problem as a result that couldn't be fixed by force-closing Safari.

Thanks for this helpful discussion. My wife has been having exactly the same problem. It is some kind of pornographic dating site that is loading, unprompted when she's browsing seemingly entirely innocuous websites. Her iphone is not jail broken. And she would never have visited any of the kind of sites mentioned as likely to 'bring this on ones self' as others have hinted or implied above.

We also have young kids, so I'll be watching this thread to see if any definitive causes or solutions are identified. And whoever watches this at Apple wants to take this very seriously. Because ****, unsought on devices our families use is utterly unacceptable. This is clearly affecting a lot of us, and solutions need to be found.

Gulifdon,

The thing I keep asking over and over but no one seems to report back on is what happens when you use Google Chrome?

Just FYI, Apple does not monitor this forum directly, you have to file bug reports at Apple.com/feedback

For me personally, I have not seen this happen or heard of it affecting anyone in my social network in America, so any insights you can give will help:

The key things we have yet to see are: cropped screenshots, name of the website(s) showing up, your country, the city you're in/near, your mobile provider and internet service provider also.

What happens when you use OpenDNS at home on wifi? (opendns blocks stuff not safe for kids)

Or even changing to Google's DNS instead (8.8.8.8)

I really want to see what the popup looks like, does it take over the entire screen? Does it show up in a new tab/window in safari? this will be instrumental in helping identify it.

Lastly, just did some research, turn off Javascript, Make sure Limit Ad Tracking is on, use a different DNS server.

(there is a thread on Macrumors saying it's some advertisements that are triggering a javasript redirect)

Hi. Thanks for the reply.

I've asked my wife to keep tabs on when it happens.

Things I can answer:

We're in the UK

Her mobile provider is Orange

Our ISP is Virgin Media - but this has happened on WiFi at home and at her father's address where the ISP is BT.

One of the websites that was being browsed, in Safari, when it happened was allpoetry.com

One of the weirdest things, and I've yet to fully understand this bit, is that it appear to take her away from Safari to deliver this content - but I don't understand how that can be. When she returned to Safari, for example, this content wasn't there, but the allpoetry page still was. I also couldn't find anything that appeared to explain what site it could have been in her browsing history. So it was like she hadn't actually seen it on a website at all!

I'm told it also happened when she was using the Words with Friends app from Zynga - on this occasion she was using the game, and put the phone down when our kids came looking for her. She picked it up moments later, and this was there. This app does serve up ads in between turns, which would lend itself to the ad server theory. But surely Zynga must be cautious enough about their rep to not allow this kind of ad to be placed?! ... I also use this app, and have never had this problem. But then I close the ads as soon as they pop up, whereas on this occasion it could have been allowed to run long enough to redirect somewhere else ... Though still surprised and shocked.

Afraid to say I don't understand the suggestion re OpenDNS. Don't understand what it is, or how I'd use it. Sorry.

I'll post any more information I find if it happens again.

Guess I'm not surprised by your comment about Apple not reading these sites formally. But I can't believe that no one connected with them wouldn't note this if it started to get a lot of traffic, and a lot more people reporting the problem. They appear to pride themselves on being family friendly, not allowing dodgy apps, and being virus free! I won't hold my breath though. I suspect you're right, and I'm being naive.

Thanks.

More info ... Just happened again:

This time, my wife opened Safari, where she'd left a window open before on Www.scrabblewordfinder.com

The browser, within a second or two, redirected to this URL:

http://mobile.[BLANK].com/tour/zmasonuk/?id=bittertest1&tour=zmasonuk&ot=best&cmp =1761.wifi.ukiccss-1_5iccss

(NB - in order to avoid getting blacklisted for posting dodgy links, I have removed the word fling and replaced it with [BLANK] in the above link - OPEN AT YOUR OWN RISK ... THIS IMMEDIATELY DISPLAYS ADULT CONTENT)

Browsing her internet history afterwards, the site linked to above appears to have left no trace. However I did find two new links (since I wiped her history a few minutes previously), both with (no title) where the name of the page would normally be listed. These were the links:

http://ads.[BLANK].com/AdServer/js/showad.js#pubId=32702&siteId=41393&adId=64733&a mp;kadwidth=160&kadheight=600&SAVersion=2&js=1&kdntuid=1&pag eURL=http%3A%2F%2Fallpoetry.com%2Fpoem%2F8562343-Recruiting-by-Ewart__Alan_Macki ntosh&refurl=http%3A%2F%2Fallpoetry.com%2Fpoem%2F8562343-Recruiting-by-Ewart __Alan_Mackintosh&inIframe=1&kadpageurl=http%3A%2F%2Fwww.allpoetry.com&a mp;operId=3&kltstamp=2013-10-26%2023%3A12%3A49&timezone=1&screenReso lution=320x568&ranreq=0.49626019573770463&pmUniAdId=0&kbgColor=fffff f&ktextColor=000000&klinkColor=0000EE&adVisibility=2&adPosition= 3033x78&ni=165%2C0%2C1%2C0

http://ads.[BLANK].com/AdServer/js/showad.js#pubId=32702&siteId=41393&adId=64458&a mp;kadwidth=300&kadheight=250&SAVersion=2&js=1&kdntuid=1&pag eURL=http%3A%2F%2Fallpoetry.com%2Fpoem%2F8562343-Recruiting-by-Ewart__Alan_Macki ntosh&refurl=http%3A%2F%2Fallpoetry.com%2Fpoem%2F8562343-Recruiting-by-Ewart __Alan_Mackintosh&inIframe=1&kadpageurl=http%3A%2F%2Fwww.allpoetry.com&a mp;operId=3&kltstamp=2013-10-26%2023%3A12%3A49&timezone=1&screenReso lution=320x568&ranreq=0.8388584335334599&pmUniAdId=0&kbgColor=ffffff &ktextColor=000000&klinkColor=0000EE&adVisibility=2&adPosition=2 442x8&ni=243%2C5509%2C0.0782%2C0.115

(In both cases I've replaced the word pubmatic with [BLANK], again to avoid getting blacklisted. And again OPEN AT YOUR OWN RISK)

(I think the idea that it was taking her away from Safari was a red herring, by the way. But still interesting that the site itself leaves no footprint in internet browsing history. I didn't know that was possible).

Thanks again.

Hi again, Chattphotos,

Thanks for taking an interest. I'm guessing there must be something clever / bad about the way the pubmatic redirects work on my wife's phone that is ensuring the site doesn't show up in history on my wife's phone - cos it definitely doesn't.

Interesting aside - but probably not relevant to the original problem. But out of interest I just visited lexical on my iPad, and now if I try to load scrabblewordfinder, it automatically takes me to lexical.

Robert Zamora, as Chattphotos correctly predicted earlier in the thread, erasing cookies and data didn't make the blindest bit of difference. We tried this, but the problem recurred.

Thanks.