8

Can visiting a malicious website infect an iOS or Android device?

We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps.

Improve this question

4 Answers 4

Reset to default
7

What day of the week is it?

In theory, no. Merely visiting a site will not infect you.

But as they say, the difference between Theory and Practice is that in Theory there is no difference.

I practice, defects in the implementations of some components of the browser are found (sometimes in Javascript, sometimes in Java, sometimes in PDF renderers, sometimes even in font rendering) that permit malicious code (or data, because it's sometimes hard to tell the difference) on a malicious website to infect even passersby. This is called a "drive-by" attack.

But that's a serious breach in security, and such defects tend to get patched very quickly.

If you visit a website on a day after the malefactors have written code to exploit such a defect but before the day your browser gets patched, then yes, you can get infected. The day before the malicious code is placed on the website, or the day after your browser is patched, you're safe.

Like I said: what day of the week is it?

Improve this answer
2
  • 2
    iOS/Android do not have a JVM; Lookout commonly cites that android vulns are fixed (from the OEM) between half a year to a year and a half (very slow) after an initial patch is pushed by Google
    – KDEx
    Dec 23, 2014 at 4:47
  • Web browser is an app, it gets updated more often than the OS. WebView is also an app these days: play.google.com/store/apps/…
    – domen
    Jan 28, 2021 at 16:22
3

Yes. When you visit a webpage on your iOS/Android device JavaScript may be loaded. This is the most common vector of attack.

Case: Android Case: iOS

(These two examples are just the top hits on Google, there are many examples of similar exploits/malicious cases)

Improve this answer
1
  • Most common? Sure, it happens, and that addjavascriptinterface bug was pretty bad, but web browser sandbox escapes are not a common thing that malware does.
    – domen
    Jan 28, 2021 at 16:17
3

A simple visit to the most innocent website you know, may trigger an attack that can lead even to a total control of your machine.

Drive-by download attacks that can exploit the vulnerabilities of your browsers and or their plugins and install without your consent or knowledge more or less dangerous malware.

Improve this answer
8
  • 1
    Could such a drive-by download actually installs its payload without having to trick the user to supply his/her admin password first? How?
    – Honey Badger
    Dec 23, 2014 at 23:12
  • @HoneyBadger of course: it occurs without any user consent. That is the principle of such attacks
    – user45139
    Dec 23, 2014 at 23:17
  • 1
    But how does a mere JavaScript script circumvent the OS and even break out of browser sandbox (such as Chrome) without user's manual participation? This is something that I don't understand...
    – Honey Badger
    Dec 24, 2014 at 0:40
  • 1
    @HoneyBadger: In iOS 1.1.1 this exploit was used by some Jailbreaking methods such as this one that only require the user to visit the website in Safari.
    – SilverlightFox
    Dec 24, 2014 at 10:37
  • 1
    @begueradj, the article on CoolWebSearch does not explain how drive-by-download works. Also, on iOS devices there are no Java applets, Flash player, or ActiveX plugins to exploit. Without vulnerable 3rd party vectors, one will have to be a very clever JS programmer to be able to break thru browser sandbox and OS permission restriction. The question is still... how did they do it?
    – Honey Badger
    Dec 24, 2014 at 12:21
3

About two years ago there was a website "jailbreakme" that allowed jailbreaking a device just by visiting it; it exploited a vulnerability in Safari's built in PDF viewer and then probably other vulnerabilities to gain root privileges and modify the kernel to allow non-signed code to run.

Although this has been patched, this proves that a mobile device is no different from a desktop computer and malware can exploit vulnerabilities such as that one to execute arbitrary code as the user, and possible using other vulnerabilities for privilege escalation and thus total compromise.

Improve this answer
2
  • So this "jailbreakme" website has a payload that was specifically written for iOS devices? In that case, visiting it with a Windows PC won't infect the machine, corrrect?
    – Honey Badger
    Dec 23, 2014 at 23:15
  • @HoneyBadger the purpose of that site wasn't malicious (and you had to explicitly click a button to jailbreak the device); a real malicious site would compromise the machine as soon as its loaded and have all possible payloads to attempt to compromise a wide range of different machines.
    – user42178
    Dec 23, 2014 at 23:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .