5

My girlfriend watched "some" pages on her iPhone and facebook.you-won.com page appeared. She didn't know how to get rid of that JavaScript alert, so she clicked OK. After that she closed the page, and sent me the link with message "what is that".

I also clicked that link she sent. In Safari I found out, that it is some phishing page, so I closed it by restarting Safari on my iPhone and before the page loaded I quickly opened "panels" and left-swiped to close that page (all before the page loaded and that JavaScript alert appeared).

Because I think it's a phishing attack that is trying to steal your ID, I have 2 questions:

  1. What can I do with HER iPhone (is restore enough to get rid of everything that could be downloaded? When she clicked OK?)

  2. What can I do with MY iPhone? (I restored and recovered last backup from last week - this "page" appeared today, is it enough that I didn't click OK?).

    • I have my work "exchange" account on the iPhone, do I have to worry?

    • I have apps that are linked to my credit account (apps from my bank), do I have to worry?

    • I have credit card information saved in the App Store, do I have to worry?

She has nothing on her phone, just Facebook and some free games, so she is without problems I guess when I recover her iPhone.

Anyway none of those devices are jailbroken. Both iPhones have their original and newest iOS.

  • 3
    I wouldn't worry about it. Apple put so much restrictions on the user himself let alone the malware would have to exploit the browser, bypass the sandboxing, perform some kind of privileges escalation and reboot the device. – Ulkoma Jul 29 '15 at 9:58
3

From the scenarion you describe, she rather has been a victim of a drive-by download attack that leads to installing -in most cases- adware or spyware but this attack can be even more dangerous depending on the malware that has been installed.

This attack uses the browser vulnerabilities or the browser's plugins vulnerabilities using mainly malicious obfuscated JavaScript code.

The attack can be triggered passively by a simple visit to a given webpage as it happened for example on 2011 to Amnesty International's homepage where lot of visitors got infected by simply reading articles on their homepage.

In an other scenarion, the attack needs the visitor to be active (which is the case of you describe here): the visitors sees pop-up windows that a simple click on the OK, Cancel or even Exit (X) button will trigger the attack.

1

The iPhone in its unjailbroken state is a highly secure platform, arguably one of the most secure. For the most part, you can’t get a drive-by download on iOS as easily as on a desktop due to the extremely good sand boxing it utilizes. Ironically, this strong sandbox model is what makes apps sharing data with each other (a perk Android users have enjoyed for some time now) so difficult to implement on iOS.

There are no antivirus products that you can install from the App Store that will actually scan your whole system. Thanks to the strong sand boxing this is impossible to implement. The most that these programs can do is scan things in your various user folders like documents and your camera roll.

As an iOS user myself, I wouldn’t worry about accidentally visiting a phishing site. As long as no user info was manually provided, everything is fine.

And while jailbreaking can make your device more unstable and less secure, properly educating yourself can do wonders to close the vulnerability gap. Not only are my own jailbroken devices more secure than normal iOS devices (thanks to security related plugins), but I even enjoy many features that Apple would rather you not have, such as ad blocking, alternative default browsers and default Google Maps. Plus nested app folders, animated GIFs in the camera roll and countless other features.

  • 4
    WHERE did you read that You can’t get a drive-by download on iOS due to the extremely good sand boxing it utilizes ??? HERE IS ONE of so many drive-by download attacks that happened on iOS. By the way, such attacks targets the vulnerabilities of browsers and their plugins, not the OS by purpose. Also, speaking about strong sandboxing: do you know that the Firefox browser you are using probably right now (as well as for Chrome, Opera ...) are also strongly sandboxed ? – user45139 Jul 29 '15 at 12:28
  • Ah, yes. A flaw that was never found in the wild, for an extremely outdated version of iOS (from 2012… iOS 5, AFAIR). Any chance you could point out a non-experimental, actually-found-in-the-wild exploit? Yeah, thought so. – René Kåbis Jul 29 '15 at 12:34
  • 3
    iOS 5 or 6 are not extremely outdated, but this is not the problem: drive-b download attacks target bulnerabilities of BROWSERS and their plugins not OS – user45139 Jul 29 '15 at 12:38
  • So you are nitpicking about a version of iOS that less than 2/100 people with Apple devices still make use of? Try focusing on real-world exploits for current systems, bub. Or to use a metaphor, don’t be bringing up Roman infantry tactics in a discussion of modern military strategies. Do try to remain relevant by staying current. – René Kåbis Jul 29 '15 at 12:52
  • 1
    Have you read my comment ? I said drive-by download attacks target BROWSERS (and their plugins) NOT operating systems !!! – user45139 Jul 29 '15 at 12:55
-1

First of all, this was some sort of malware, not phishing. Phishing is successful only when you enter your credentials thinking you're on a legitimate site.

Go to the Apple Store and install an antivirus for both of your iPhones. (Unfortunately I can't give suggestions here. Avast is the best-rated AV for Android devices; I don't know what is worth for iOS, but you could give it a try. F-Secure is a good one too.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.