5

When using Chrome on my Nexus 6, I often get taken to a data URI that causes a modal that reads something like:

An embedded page at s3.amazonaws.com says: Message! Congratulations Grande Communications user, you have been chosen for a chance to get a new iPhone.... Click OK to continue

There is no Cancel button. Why does Google allow developers to launch pop-ups with no cancel button?

This doesn't occur from clicking on a link. Usually it happens while I'm on a tab, and suddenly another tab will spawn with the modal. I don't think it's caused by a visit to a dubious host, because it's happened when I've had only top sites (Amazon, ebay, etc.) open in the other tabs.

I have run Malwarebytes and a few other security tools and they all say my phone is secure and clean.

What exactly is happening? On the standard Chrome browser, web extensions can rewrite URLs but Chrome for mobile doesn't have web extensions. Could an app intercept network calls from the browser? Could the sites I'm visiting just be serving malicious ads?

  • Try clearing the browser cache and see if that repeats? – beeshyams Aug 28 '16 at 3:24
  • Can you do some testing to try to narrow down websites you see it on. I would be surprised if the big guys were hijacked in this way. Are you seeing this over HTTPS? – Alexander O'Mara Aug 28 '16 at 3:37
  • Also are you seeing this on Mobile internet or Wifi or both? I.e. if you go and turn off cellular and connect to a 3rd party wifi say Starbucks Wifi - do you see the popup? – Morrison Chang Aug 28 '16 at 4:37
  • I see this at home over WIFI. – Musical Shore Aug 28 '16 at 7:19
  • Neither clearing the browser cache nor deleting suspicious software helped. – Musical Shore Aug 28 '16 at 16:17
1

Actually nothing is malicious or exploitable of what you described.

The popup without a cancel button is just a javascript alert. When you press OK nothing happends because you pressed OK. You get redirected because that's simply the next line in the javascript script.

These misleading ads can be blocked with an ad blocking app such as AdAway, although they require root. You could also simply use the Adblock Browser.

Unless you download or install content from such malicious websites you are malware free. Even if they open already installed apps on your phone (Such as Google Play or Gmail) nothing malicious will happen without your consent.

tl;dr
Watch what you allow/install

2

To build to what we know, I just saw this today on a stock Nexus6P (TMo) running the August update, only in 'ChromeBrowser'. Previously, it was happening to a roommate's unrooted Galaxy S4 (AT&T), which now that I think about it, was running an even more current version of 'Chrome' than I was. No wifi, separate mobile networks. I updated in the past 24 hours and saw my first URI within an hour of googling this post and adding. The only websites I've used since the last boot have been Google, Wikipedia, Reddit, Amazon, and IMDB.

Tried clearing the system cache on both phones, uninstalling and reinstalling 'Chrome', running 'Malwarebytes' and 'Avast': still happens. Doesn't seem to be happening in 'Adblock Browser'.

If anyone can decipher the string that prompts mine, it looks like:

data:text/html;base64,PCFET0NUWVBFIGh0bWw+PGh0bWw+PGhlYWQ+PG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgdXNlci1zY2FsYWJsZT1mYWxzZSwgaW5pdGlhbC1zY2FsZT0xLjAsIG1heGltdW0tc2NhbGU9MS4wIj48L2hlYWQ+PGJvZHk+PGRpdiBpZD0iaWZybSIgc3R5bGU9InBhZGRpbmc6MDsgbWFyZ2luOjA7Ij48aWZyYW1lIHNyYz0iaHR0cHM6Ly9zMy5hbWF6b25hd3MuY29tL3d3dy5hb3RxNGpncXk5bjcxLmluZm8vVVMvaGFramxoZmNsaXViY2NsdTIyYWEybGNpYnV5YS5odG1sIiBzdHlsZT0idG9wOjA7IGxlZnQ6MDsgd2lkdGg6MTAwJTsgaGVpZ2h0OjEwMCU7IHBvc2l0aW9uOiBhYnNvbHV0ZTsgYm9yZGVyOjAiIHNjcm9sbGluZz0ieWVzIiBhbGxvd0Z1bGxTY3JlZW49InllcyI+PC9pZnJhbWU+PC9kaXY+PC9ib2R5PjwvaHRtbD4=

  • 1
    The code is HTML code of a frame with an ad inside. You can decode it by using a Base64 decoder. – Ciprum Aug 29 '16 at 22:33
0

I found today that it does it on the same site every time I pass it. It must be an ad from that page launching it. As long as you push the back button and ignore it there doesn't seem to be any problem. I do hope they figure out a way to eliminate those ads, it's irritating and a lot people aren't aware enough to just leave it alone.

0

Same thing happens on any website I go to from amazon to target even over powered my banks website, happens on 2 different phones a note 5 and a galaxy s7 edge. Started on the note first now it's doing it on the s7 edge. I can never recreate when it happens I just know it will... the notes stock att bloat ware running the newest android version, the s7 is the same but has never had any apps installed on it other then what my company put on it when they gave it to me can't even go to certain websites with the phone but this same code pops up at random. It always happens on the stock Samsung Web browser haven't seen it happen on chrome yet

data:text/html;base64,PCFET0NUWVBFIGh0bWw+PGh0bWw+PGhlYWQ+PG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgdXNlci1zY2FsYWJsZT1mYWxzZSwgaW5pdGlhbC1zY2FsZT0xLjAsIG1heGltdW0tc2NhbGU9MS4wIj48L2hlYWQ+PGJvZHk+PGRpdiBpZD0iaWZybSIgc3R5bGU9InBhZGRpbmc6MDsgbWFyZ2luOjA7Ij48aWZyYW1lIHNyYz0iaHR0cHM6Ly9zMy5hbWF6b25hd3MuY29tL25vdGlmaWNhdGlvbmNlbnRlci91cy9pbnN0YW50d2lubmVyL2c5WFdOb01Kam5NSEN4bW54UHFqWWtORDd6US5odG1sIiBzdHlsZT0idG9wOjA7IGxlZnQ6MDsgd2lkdGg6MTAwJTsgaGVpZ2h0OjEwMCU7IHBvc2l0aW9uOiBhYnNvbHV0ZTsgYm9yZGVyOjAiIHNjcm9sbGluZz0ieWVzIiBhbGxvd0Z1bGxTY3JlZW49InllcyI+PC9pZnJhbWU+PC9kaXY+PC9ib2R5PjwvaHRtbD4=

  • And it's been a amazon add where I won an iPhone 7 before that it was Walmart gift card for 500$ – Eric Leopold Sep 17 '16 at 6:33
  • Has anyone taken it into a store and see if they have an answer... it really seems to be an issue with the new Android operating systems. My phones didn't start doing it units this last update. – Eric Leopold Sep 17 '16 at 15:06
0

Disable the Java-script on that Website, I think it will remove the problem. It is not some sort problem related to virus,it is no-script function which is triggered by java-script when you click on page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.