iOS Popup Scam
Analysis and response to an iOS scam that prompts a user to download a suspicious application from the Apple App Store.
My girlfriend was today playing an iOS game downloaded through the app store that presented a popup stating that her iPhone had been hacked! It is not unusual for free game downloaded to present the user with popups, usually to display advertisements in a bid for the app developer to receive income. Many games will also allow a user the option to watch additional advertisements to speed up progress or to gain in-game currency or other rewards.
In this particular instance, the game presented the below popup. Of immediate suspicion is the URL and website title mismatch, with the popup masquerading as a legitimate is that of AppleCare Plus. The tried method of instilling a sense of urgency to the end user is leveraged with a proclamation that the target device has been hacked and that immediate action is required.
Investigation
Breaking down the URL grants the following information:
linkthetrafficmedia.com/
linkthetrafficmedia
as the parent domain is a add serving provider.Address: 104.21.94.70 (CloudFlare CDN)
HFmx46Qr
The filename of the page being served. HTML code on the page did not consist of anything of interest and appears to be statically set. This value is highly likely to change.
cost=0.001972746
Possible cost per add served?
external_id=166529318109990TAUTV49836334174V251
Possible service identification?
ad_campaign_id=304067220
An identification number for the add campaign
source=6307776-624692278-4260646726
Possible user identification?
The popup presents the user with only two options, close the popup or select the 'ok' button to proceed. Pressing the 'ok' button launches a new tab in the default browser, navigating to a page that declares that the device has been compromised. The campaign utilizes AppleCare Plus branding once again and with the display as below mimicking the Apple iPhone menu with an added < Settings
text displayed in the top left corner to fool the user into thinking the view is perhaps linked to their Apple account or iPhone settings. Exiting out of the popup does not launch any further popups or windows.
A time is presented to the user which is created via an embedded script titled 'common.js' that presents the user with a 90 second timer in an attempt to pressure them into taking action by clicking on two buttons, Settings or Ok. Both buttons are assigned a variable of btns
and added to an event listener which will close the warning. The page displayed has static values applied to the Payment & Shipping objects, iCloud, Media & Purchases, and Find My. These statically set values are done so within the HTML code.
Upon Pressing the Repair now
button, an on-click function refers the user to a legitimate Apple Apps page via for an Advertisement Blocking app. Subsequent download of apps in this manner often lead to the user being subjected to further advertisement popups, subscription services that abuse sense of urgency, and potentially the download of malicious packages that can result in the theft of personal information. Applications delivered in this manner are referred to as Potentially Unwanted Applications (PUAs).
Remediation
If a user falls victim to such attack, it is highly recommended to take the following remediation actions for Safari. Other web browsers such as Microsoft Edge, Mozilla Firefox and Google Chrome will have similar procedures:
Clear iPhone/iPad History and Data
Settings > Safari
Clear History and Website Data
Disallow JavaScript Execution
Settings > Safari > Settings > Advanced
Toggle the JavaScript button to off
Apple provide a great reference for Recognizing and avoiding phishing messages, phony support calls, and other scams.
IOCs
Object | Value | Description |
---|---|---|
URL | hxxps://linkthetrafficmedia.com/HFmx46Qr | Serves popup through advertisement. |
IP | 104.21.94.70 | CloudFlare CDN hosting linkthetrafficmedia[.]com |
App | Neo Protect: AdBlock | Application offers AdBlocking services, subscription service is offered at USD$7.99 per week. App Store URL : hxxps://apps.apple.com/kg/app/neo-protect-adblock/id1572287518 |
Last updated