I had an uncommon issue with both Safari and Chrome on an iPhone 6 running iOS 9.0.1 last night - a number of sites were displayed with altered links and/or additional links (clearly from a third-party source) and occasional ads in pop-ups (marked Ads by DNS Unblocker).

They were not part of the site. AND They were not injected on network or ISP-level, changing DNS settings and trying other ISPs did not resolve the issue - they were an artefact created within iOS.

Clearing the caches / website data on both Safari and Chrome resolved the problem.

HOWEVER: I am worried because both apps (and as such sandboxed) seemed to have the same issue, indicating a broader security breach than I would have expected on iOS.

A few questions: How do systems like "DNS Unblocker" work on platforms like iOS? It seems links are altered and additional HTML is injected on third party sites. The malicious code sits somewhere in cached website content / cookies / etc. I'd like to understand the mechanism in order to ensure that the system is now safe.

How does the code injection work? And more importantly: could it have compromised other apps on the system?


EDIT: this is the page on which I could replicate the exploit http://m.kurier.at

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.