At least 12 Dutch websites warn of malicious ad code that tried to hack old iPhones
At least 12 Dutch websites have warned visitors of malicious code that was distributed through ads, which collected users’ date and attempted to access personal information on certain outdated iPhones. The sites include Vl.nl, VoetbalPrimeur, VoetbalNieuws, Bright, Scientias, Autoblog, Men’s Health, Women’s Health, Runner’s World, Bicycling, GeenStijl, and Autoreview.nl, all of which used the same advertising partner.
Vl says data on website visits was obtained without visitors having to click anything. This includes IP addresses, pages visited, language settings, and information about the operating system. The collected data was sent to a server controlled by the attackers.
The code was also used to try exploiting security vulnerabilities of certain iPhones, potentially allowing access to stored passwords, app login credentials, messages, photos, contracts, and cryptocurrency wallet keys. It has not been established whether private data was stolen or whether any individual iPhones were successfully compromised, Vl reports.
“An unauthorized third party gained access to the management system and made unauthorized changes to it. This allowed malicious code to be added to an advertising tag that we used on Vl.nl, among other sites,” Vl wrote on its website.
Vl says the code has since been removed and the vulnerability in the advertising system has been fixed. The football site is now investigating the possible further consequences.The advertisin company involved, PXR NextDay, manages ads for around 150 websites that together reach approximately 12 million visitors a month.
According to the publishers, the malicious code was active in several windows: from roughly 09:50 on November 1 until 10:07 on November 3, with a second insetion on November 3 between 12:06 and 17:30. A further unauthorized change on November 11 between 15:34 to 15:50 was then also reported.
The code targeted certain iPhone models that do not have the latest security updates installed. Those include the iPhone XS, XR, 6s, 7, and first-generation SE.
Publishers advise anyone who visited one of the affected sites between November 1 and 3 on a vulnerable iPhone to install the latest iOS update immediately. They also recommend changing passwords stored on the device, preferably from a different trusted device. Enabling two-factos authentication, monitoring for unusual login attempts, and being alert to phishing messages are also important.
Users with a cryptocurrency waller on the phone are advised to move funds to a new wallet with a fresh recovery phrase created on a secure device.