Chrome browser hijacked, android phone

[tompelli]

Samsung J7 android phone running up to date chrome browser. Visited Bangkok post website & got a (fake?) virus warning. Of course whenever I re-open browser it goes to the same site. Google throws up the possibility of a malicious add-on to any newly added apps. First time I try to delete chrome it offers the possibility to return to the original Samsung installed chrome. Do that & the warning re-appears. So I switch browser to chrome beta, which can be deleted & re-installed. Malwarebytes and  AVG don't find anything, so I guess I just have to avoid the Bangkok post site...not saying it's them, just 3 times is too much of a coincidence. The warning comes from https mydev-installssubsite (Don't want anyone going there by accident).

[cornishcarlos]

I got the same from Bangkok Post... Managed to just do a full restart and seems to have gone now !

[johng]

Root the phone and install a nice "host file"

[tompelli]

9 minutes ago, cornishcarlos said:

I got the same from Bangkok Post... Managed to just do a full restart and seems to have gone now !

By full restart you mean just shutting down? Did that, but next time I visited bkk post bingo! If not can you let me know what you mean...I'm no bill gates. 

[tompelli]

10 minutes ago, johng said:

Root the phone and install a nice "host file"

I'll need a bigger phone if I'm going to root it.

[tompelli]

I have a screenshot of the warning, but no idea how to post it.

[cornishcarlos]

I just restarted the phone and not been back to Bangkok Post since, no more issues :)

[johng]

I'll need a bigger phone if I'm going to root it.

Errr well maybe not that kind of "rooting"
maybe they call that "cybersex"

[Pib]

I had the exact same issue when using Chrome on the Bangkok Post mobile website using my mobile phone....both my Samsung S4 and Samsung A8+ phones. 

 

Your browsing session would intermittently get hijacked saying you had a virus.  And it was harder than heck to get rid of that page...you close Chrome...got back into it and you are automatically hijacked again.   When hijacked the webpage would say within 5 minutes with a count down clock every file on your phone will be infected unless you clicked a link which just took you too a Google Play antivirus app that cost a few bucks.   And to repeat this hijacking was intermittent. 

 

While hijacked you could open a second tab in Chrome which then allowed you to go to the hijacked tab/page and close it.  You can now use Chrome again.  You would now be good to go until you went back to the Bangkok Post website when you would eventually get hijacked again.   I could not get through one day without getting hijacked when going to the Bangkok Post website.   Could surf dozens of my other websites using Chrome and not have a problem/a hijacking.

 

Man, I did all kinds of virus scans with several anti-malware apps like MalwareBytes, Norton 360, etc....they always came back clean.   Deleted/cleared cookies, web browsing history, etc....nothing helped.   Go the the Bangkok Post website and eventually/intermittently get hijacked again with the "your are infected with a virus warning."

 

But I figured out the problem....no, your phone is not infected with any virus.   It's a instrusive 3d party cookie from the mobile Bangkok Post website and in the mobile Chrome the 3d party cookie default setting is set to "allow" 3rd party cookies....the reverse of the deskstop/computer version of Chrome whose default is not to allow 3d party apps.  Additionally, this intrusive cookie only appears if  you go to the mobile m.bangkokpost.com website since its trying to sell you  mobile app; not the regular/desktop bangkokpost.com website.

 

The fix is on your phone: open Chrome, press the 3 dots in the upper left hand corner,  press Settings, press Site Settings, press Cookies, and un-check Allow third-party cookies.   You have now blocked 3d party cookies using Chrome mobile.    Now the Cookies setting is set to "Allowed, except third party."

 

Problem fixed.  No more hijacking by going to the Bangkok Post mobile webpage if using the mobile Chrome browser on  your phone.   Before I couldn't get through one day without getting hijacked by going to the Bangkok Post mobile website...after changing the mobile Chrome setting several weeks ago the problem is fixed/hasn't come back no matter how many times I go to the Bangkok Post mobile webpage every day.

 

But the core problem is the Bangkok Post website is hungry for ad revenue and allowing instructive websites/cookies.

 

Edit: forgot to mention since that intrusive 3d party cookie is probably on your device already best to delete it right before/after you make the 3rd party cookie setting change I talked above.  In Chrome, go to the three dots in upper right hand corner, press Settings, press Privacy,  press Clear Browsing Data, press Clear Data.     After clearing the cookies, be sure you have made the 3rd party app setting change otherwise that intrusive cookie will just come back to you once you visit the mobile Bangkok Post website....but by blocking 3d party cookies it can not get on your phone again and hijack your Chrome browser.

 

 

Edited April 28, 2018 by Pib

[Pib]

Snapshot from my phone.   "Uncheck Allow third-part cookies." 

 

For you folks using Chrome on your mobile device to access the Bangkok Post webpage and who have been getting hijacked with the fake virus webpage, I think you will find your mobile Chrome setting I have pointed to/circled below will be checked which allows 3d party cookie.   You do not want this if you plan to visit the Bangkok Post webpage (or other websites) with intrusive ads/cookies....too hungry for ad revenue.

 

Uncheck it and clear your cookies on your device and you should be good to go in visiting the Bangkok Post webpage without intermittently getting hijacked by the fake virus webpage.   It fixed my hijacking problem with the Bangkok Post webpage.

 

[jenny2017]

On 4/17/2018 at 3:04 PM, tompelli said:

I have a screenshot of the warning, but no idea how to post it.

You can send the screenshot to your PC/notebook via Bluetooth, or to your e-mail address.

Then you save the file on your desktop ( for example) and click on "choose file". Then you search for the file, click on it and it will be uploaded.

 

  That's all. 

   

[mtls2005]

https://tech.thaivisa.com/new-malware-targeting-android-users-thailand-heres-stay-safe/28476/

 

https://securelist.com/roaming-mantis-uses-dns-hijacking-to-infect-android-smartphones/85178/

 

Edited April 29, 2018 by mtls2005

[tompelli]

Thanks Pib Jenny2017 & mtls2005 . Finally  got rid of the loop I was in. Happy to get rid of chrome beta as it is huge compared to chrome (although it does have 3rd party cookies unchecked by default). Mystery solved!