3

What is the cause of this chrome bug on android? The last site I went to was www.destructoid.com and all of a sudden it gets redirected to the following url. This happened previously awhile back, but I didn't document everything as I did today. I'm also on android chrome canary if that matters.

I took some screenshots before closing out of that tab. But my question is:

  • What chrome bug or malware is causing these random redirects?
  • How can one detect if they have this vulnerability?

The url is: warning: open in incognito mode

enter image description here enter image description here

  • These are never real. A website cannot know if you have a virus. It's usually a scare ad making you download their app – aBochur Jan 23 '18 at 19:05
  • yea but how did it redirect me when i was viewing another site? or was that site infected with a virus and not my phone? – Patoshi パトシ Jan 23 '18 at 19:55
7

In short:

Nothing to worry about, unless you have downloaded an app suggested by the pop-up.

In More detail:

It's an old issue. You visit a normal website, and suddenly you see pop-ups telling you that your phone has a virus.

It's called scareware. It's basically "ads" which scare you into downloading their "anti-virus" apps. Many times, the apps you will download are the ones with malware.

Why they show up:

When you see it on big websites like New York Times, it's not because the website is intentionally sending these ads; rather, it's because the innocent looking ads that the website is selling space to are laden with hidden code, which then allows them to display scareware without the website publisher knowing about it.

Many social media posts lamented that even top-tier publishers like The New York Times and The Atlantic were willing to run such intrusive ads on their sites. But experts say the problem isn’t with lack of discernment on the part of site publishers but with an extremely complex online advertising system that makes it hard for publishers involved to detect, let alone weed out, misleading and malware-laden ads. Source

Every website you visit is able to tell what phone you are using. This info is sent to the website by your browser. The scareware ads then use that info to make their warning look more real and scary.

You can even have a look at this website using your browser, it will tell you exactly what phone and Android version you're using.

What to do:

There is nothing to worry about, as the websites you visit have no way of knowing if you have a "virus" and therefore, the info cannot possibly be true.

When you get such a warning, simply close your browser. You can also clear the cache just in case (settings → apps → [browser name] → storage → clear cache).

If you do download the advertised app, make sure to uninstall it, or even factory reset your phone.

the Good news:

There's a simple way to disable these popups as explained by Android Police:

If you want to manually turn on the feature, and deal with whatever lingering bugs it currently has, it's pretty simple. Just copy chrome://flags/#enable-framebusting-needs-sameorigin-or-usergesture and paste it in the address bar (you can't tap on that link directly). Then tap the highlighted dropdown menu, change it to 'Enabled,' and restart the browser when asked

  • Great answer. Have an upvote. You could also elaborate on how the scareware is able to discern the device being used, for the sake of completeness. – Death Mask Salesman Jan 25 '18 at 20:22
  • @DeathMaskSalesman great idea if I'd know myself. I did write that the browser provides that info to any website you visit. How exactly it is sent, i don't know. I'll do some research – aBochur Jan 25 '18 at 21:46
  • This particular piece of info is known as the user agent. You may want to look up why it is sent around and how to supply a dummy one. – Death Mask Salesman Jan 26 '18 at 7:39
  • I'm using Chrome 64 when I got same message and now I'm on 65? – alexus Mar 13 '18 at 20:10
  • @alexus I'm not sure i understand your question – aBochur Mar 13 '18 at 20:20

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.