Browser redirect hijack

[mark7914]

Hi,

This starts strangely. Bear with me.

We tried to watch something on our Panasonic TV in the YouTube App. That closed itself after about 10 seconds of play. This was reproducible.

Odd. Maybe YouTube is down. Later, we tried to watch something on the iPlayer app which did exactly the same.

Maybe the TV is faulty. Maybe the Viera connect (the "smart" bit) platform has had an update that broke it. I shall check.

I check on my S8 phone with the search "Panasonic viera youtube iplayer stopping". I click one of the links. Can't be sure now but I think it was the which.co.uk one. Looked perfectly normal, nothing suspicious.

I then got taken to "webs-online-2016-web.site" and a modal dialog box told me that my S8+ (it's actually an S8) is infected. This, having searched, is a well known-exploit. Albeit from years ago.

This also somehow managed to activate the vibrate on the phone continuously, which is a mystery and sinister. This shouldn't be possible, surely. Makes me concerned that the intrusion runs deeper than a popup.

Didn't click the popup. I close the browser. Then open it again. It remembers the last page, so up it pops again. I force a close and delete all the Chrome saved data, cookies, etc and reboot.

It has gone now. Yet, still the TV has the same problems with those apps. YouTube and iPlayer stream fine on my PC. There is no unusual network activity nor any sign I can find of a hijack at a modem/router level.

I can view the offending result page on my PC (Edge, not Chrome) when I do the same search in Google. It works fine. Malicious advertiser on the which.co.uk site, maybe?

Back on the phone: OS and app updates are all disabled so they do not download and install automatically (I prefer only to update if there is a need to do so - if it ain't broke don't fix it). Have only had the phone a week.

The only new app is called "Memrise" which I used for the first time this morning a few hours before. Seems reputable, probably a coincidence.

Phone appears OK now, though I can't be sure. TV is still "broken".

These could be two entirely unrelated things but I can't help but be suspicious that there could be some connection.

1. Might there be a connection or am I right in thinking these are two unrelated things and it's a coincidence?

2. Should I check anything else on the phone? I can't see any way in which anything could have "been installed" as I gave no authorisation for anything like that and updates are all disabled. The browser must be "isolated" from the OS to prevent the phone being infected, it surely can't be possible for anything the browser does to "damage" the OS.. but then it surely can't be possible for the browser to control the vibrate function, and it was able to do just that. Which is what concerns me most.

3. Can anyone suggest a good browser that can't be 'corrupted' so easily?

Thanks,
Mark

 

[mark7914]

Thanks for reading all that. Sadly, it has happened again in Chrome. Different link this time.

Somehow it's able to be manipulated, so it's basically useless now as each time this happens it's necessary to completely clear all the app data and reset it.

Phone is now very hot and running out of power.

Installed AVG. That can't find anything wrong.

Bit stumped here. The only thing I've done differently is install and use the Memrise app (language learning).

Maybe that's malicious. Though I doubt it and it still doesn't explain why the smart apps on the TV keep closing themselves. I find that quite a coincidence.

Any ideas..

 

[Gayle Lynn]

The phone is new. Return it or do factory refresh.

Adware and malware don't play by rules. They use their own C&C.

So, where dud you buy it?

 

[mark7914]

Apologies for my rambling earlier.

I've checked everything thoroughly. Only my phone (on this network) was affected by the hijack and it seems it only affects Chrome, or, that it can only manipulate Chrome.

I've ditched that for Microsoft Edge and I cannot reproduce the problem, so I've then gone on to disable Chrome - for whatever reason it does not appear possible to uninstall it.

Edge seems to work very nicely so I'll stick with that.

The problem with the TV is therefore something else that will involve conversations with Panasonic.

 

[Gayle Lynn]

Use Samsung Internet plus 5 adblock extensions.

Install Adguard.com
Wipe cache partition

Don't set tabs to reopen
Use private mode
Turn off JavaScript
...
I'd still flash it back to factory and clean install

 

[jeffmd]

The browser exploits to redirect the pages are still there and a part of chrome. Its been a long time complaint but it looks like they may finally be fixed in the next big chrome release. Until then the only way to stop it is browsing with javascript turned off.

However the redirect did not suddenly give apps root access. Nothing was installed or changed with other installed software . Your previous issues were unrelated.

 

[Kevin82485]

Check out this thread over at the Google Help Forum: https://productforums.google.com/forum/#!topic/chrome/cCJTpaM-AhI

Basically you need to opt out of ad personalization because fake, scamming advertisers are hijacking adwords and following you around the Internet. I was having problems with this for months when using Firefox or Chrome, tried various anti-virus apps, reset my phone, nothing worked until I opted out of personalized ads and reset my advertising ID.

Check out the post for more detailed info.

 

[DerezZYT]

Bitcoin mining seems like, try using built in anti virus software