{"id":336945,"date":"2017-03-28T12:27:00","date_gmt":"2017-03-28T04:27:00","guid":{"rendered":"https:\/\/www.macrumors.com\/2017\/03\/28\/ios-10-3-ransomware-safari-exploit-patched\/"},"modified":"2017-03-28T12:27:00","modified_gmt":"2017-03-28T04:27:00","slug":"javascript-based-safari-ransomware-exploit-patched-in-ios-10-3","status":"publish","type":"post","link":"https:\/\/people.utm.my\/asmawisham\/javascript-based-safari-ransomware-exploit-patched-in-ios-10-3\/","title":{"rendered":"JavaScript-Based Safari Ransomware Exploit Patched in iOS 10.3"},"content":{"rendered":"

iOS 10.3<\/a>, released to the public this morning, fixes a bug that allowed scammers to attempt to extort money from iOS users through a JavaScript pop-up in Safari.<\/p>\n

As explained by mobile security firm Lookout (via Ars Technica<\/a><\/em>), the scammers targeted iOS users viewing pornographic material and abused JavaScript pop-ups to create an endless pop-up loop that essentially locked the browser if the user didn’t know how to bypass it.<\/p>\n

\"\"
Using “scareware” messages and posing as law enforcement, the scammers used the pop-ups to extort money in the form of iTunes gift cards from the victim, promising to unlock the browser for a sum of money.\n<\/p>\n

\n

The scammers abused the handling of pop-ups in Mobile Safari in such a way that a person would be “locked” out from using Safari unless they paid a fee — or knew they could simply clear Safari’s cache (see next section). The attack was contained within the app sandbox of the Safari browser; no exploit code was used in this campaign, unlike an advanced attack like Pegasus that breaks out of the app sandbox to install malware on the device.<\/p>\n

The scammers registered domains and launched the attack from the domains they owned, such as police-pay[.]com, which the attackers apparently named with the intent of scaring users looking for certain types of material on the Internet into paying money.<\/p>\n<\/blockquote>\n

The endless pop-up issue could be fixed by clearing the Safari cache, but many users likely did not know they didn’t need to shell out money to regain access to their browsers.<\/p>\n

Pop-up scams are no longer possible with iOS 10<\/a>.3, as Apple has changed the way pop-up dialogs work. Pop-ups are now per-tab and no longer take over the entire Safari app.<\/p>\n","protected":false},"excerpt":{"rendered":"

iOS 10.3<\/a>, released to the public this morning, fixes a bug that allowed scammers to attempt to extort money from iOS users through a JavaScript pop-up in Safari.<\/p>\n

As explained by mobile security firm Lookout (via Ars Technica<\/a><\/em>), the scammers targeted iOS users viewing pornographic material and abused JavaScript pop-ups to create an endless pop-up loop that essentially locked the browser if the user didn’t know how to bypass it.<\/p>\n

\"\"
\n
\nUsing “scareware” messages and posing as law enforcement, the scammers used the pop-ups to extort money in the form of iTunes gift cards from the victim, promising to unlock the browser for a sum of money.<\/p>\n

The scammers abused the handling of pop-ups in Mobile Safari in such a way that a person would be “locked” out from using Safari unless they paid a fee — or knew they could simply clear Safari’s cache (see next section). The attack was contained within the app sandbox of the Safari browser; no exploit code was used in this campaign, unlike an advanced attack like Pegasus that breaks out of the app sandbox to install malware on the device.<\/p>\n

The scammers registered domains and launched the attack from the domains they owned, such as police-pay[.]com, which the attackers apparently named with the intent of scaring users looking for certain types of material on the Internet into paying money.<\/p><\/blockquote>\n

The endless pop-up issue could be fixed by clearing the Safari cache, but many users likely did not know they didn’t need to shell out money to regain access to their browsers.<\/p>\n

Pop-up scams are no longer possible with iOS 10<\/a>.3, as Apple has changed the way pop-up dialogs work. Pop-ups are now per-tab and no longer take over the entire Safari app.<\/p>\n

Related Roundup: iOS 10<\/a> <\/div>\n

Discuss this article<\/a> in our forums<\/p>\n

\n<\/img><\/a> <\/img><\/a>\n<\/div>\n

\"\"\/ <\/p>\n","protected":false},"author":5817,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25],"tags":[68,69,59,26],"class_list":["post-336945","post","type-post","status-publish","format-standard","hentry","category-technology","tag-apple","tag-macrumors","tag-media","tag-technology"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/336945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/users\/5817"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/comments?post=336945"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/336945\/revisions"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media?parent=336945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/categories?post=336945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/tags?post=336945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}