0

Every now and then (say 1-2 times per day) my phone asks me to open a webpage while I'm using it. It doesn't happen in the browser, it happens from any app. I don't have any default browser set up, so I get the "open with..." dialog box. I tried to open some of them with Opera Mini (which somehow is less prone to hacks I guess) and every time the url (even the domain) is very different.

How can I understand which app (if any app is to be blamed) is causing this? What else can I do?

One example url: us.unidingcom.com/spac/redirect.html?model= (etc etc). Others were totally different.

Another: global.msmtrakk06d.com

3
  • Any of the apps have adverts in? – Matthew Jan 12 '17 at 11:03
  • normally this is due to some app you have installed, I had a very similar issue with an app from the play store opening a web page i did not want. review what you have installed before this started happening. – iainpb Jan 12 '17 at 11:08
  • meanwhile, your phone could be downloading more stuff from the internet, if you lose to much time trying to probe the "infected app". take a look at my answer. – user28177 Jan 12 '17 at 18:43
1

This random URL pattern is something very common on C&C Malware. This funcion is called Domain Generation Algorithm, that commonly generate URLs like www.<gibberish>.com.

Things you could do to probe what apps on your Android Phone could be causing this problem:

  • Check what apps were not installed from Play Store. There is a great chance that those are the one to blame. Many reports from popular games like Pokémon GO or Super Mario Run are injected with Malware. Once those are installed, is difficult to audit what are they doing, unless you use the least privilege principle and deny all access to them(camera, gps, calls, sms..)
  • Depending on your Android version, you will have App Permissions at your disposal. This could be a pain, denying permissions to every app and allowing them when asked, but, its a method to try to probe if any rogue app is trying to use your GPS or Front facing camera for example, without you actually having that app on foreground(active app);
  • Reset to factory defaults. This could be an option, unless your phone is cursed by firmware malware.

I Think that you will lose more time trying to probe the malware(giving it more time to better entangle your device, and capture more data), than making a backup of your important stuff and reseting it. Maybe, even better than just reseting to factory defaults would be using your phone maker software to reflash a clean firmware through USB.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.