Regarding Reddit Opening up Shady NSFW Website in App-Browser and Security Exposure

[9138988]

Hello, the other day while on reddit the other day, I opened a v3.redgif.com link through the inn-app browser on reddit, This was by accident as I thought the reddit post that opened it was simply a video, instead it redirected me to this website with this video playing, a pop-up prompt also appeared which said something along the lines of “Your content could not have been downloaded”, I clicked Ok, then immediately exited out of the website by clicking done in the inn-app browser. This is a legitimate redirect and legitimate website, but I have one question, is there anyway that the website could have compromised my device since I was on it? And since I interacted with the prompt?

Can an iphone be hacked by being on a shady website and responding to prompts?
I will make sure to never open a link of this nature ever again.

Thank you.

 

[TMRJIJ]

Pretty much all of the iOS apps are sandboxed when using an in-app browser. It is very unlikely that your phone could have caught something from that one redirect.

 

[9138988]

Pretty much all of the iOS apps are sandboxed when using an in-app browser. It is very unlikely that your phone could have caught something from that one redirect.

Alright, thank you, so are the in-app browsers completely sandboxed? So if there was something malicious going on it would not be able to spread to the rest of the system?

Additionally, is this the same for the regular safari?
Im a little bit worried that somehow something downloaded on my phone through this, thats what Im trying to understand.

 

[TMRJIJ]

Alright, thank you, so are the in-app browsers completely sandboxed? So if there was something malicious going on it would not be able to spread to the rest of the system?

Additionally, is this the same for the regular safari?
Im a little bit worried that somehow something downloaded on my phone through this, thats what Im trying to understand.

In-App Browsers are a feature of Safari so the same security features remain. The app itself does not have access to potentially sensitive user data nor can it change anything outside of its controller, only the app itself. Furthermore, the JavaScript environment is not accessible from the main app, and SSL certificates cannot be bypassed making it pretty trustworthy.

If you're still worried, you can also clear your website data from Settings > Safari. Most likely, that site's cache is not even there.

 

[9138988]

In-App Browsers are a feature of Safari so the same security features remain. The app itself does not have access to potentially sensitive user data nor can it change anything outside of its controller, only the app itself. Furthermore, the JavaScript environment is not accessible from the main app, and SSL certificates cannot be bypassed making it pretty trustworthy.

If you're still worried, you can also clear your website data from Settings > Safari. Most likely, that site's cache is not even there.

Thank you sir for all of the help so far.
Im a person with a bit of anxiety so I’d like to kindly and humbly ask if you could give me some more clarity through your wisdom on this topic, again i wish I could express how gratitude I am for some help against my fears.

Essentially, I’d like to inquire deeper on a few more things, so as of now is it safe to say that even if there was any malicious intention with the redirect, safari does not allow malicious websites to install any sort of malware or spyware on the iPhones operating system because of its sandboxed nature, and this is true for both regular safari and the in-app safari browser irregardless of me interacting with that websites prompt?

Thank you very much.

 

[9138988]

If you're still worried, you can also clear your website data from Settings > Safari. Most likely, that site's cache is not even there.

What makes it certain that the sites cache is not there?
And thank you, I just went and did that.
Is there any documented history of an Iphone to be hacked via web-traffic and visiting malicious websites and interacting with them on IOS 16? Or is that just simply
Impossible?

I also run lockdown mode for additional security measures, just incase that helps with details

Thanks.

 

[TMRJIJ]

What makes it certain that the sites cache is not there?
And thank you, I just went and did that.
Is there any documented history of an Iphone to be hacked via web-traffic and visiting malicious websites and interacting with them on IOS 16? Or is that just simply
Impossible?

I also run lockdown mode for additional security measures, just incase that helps with details

Thanks.

Not that I'm aware of for iOS 16. There are some sites that crashed iPhones in much older versions, but Apple was relatively quick at fixing those security holes. Now, Apple can simply push out security fixes without the need for a full software update.

Lockdown Mode is a higher level of protection designed for the very few people who may be personally targeted by some of the most sophisticated digital threats due to who they are or what they do. For the general population, it is not necessary. You're not planning on running for a political office by chance, are you?

 

[9138988]

Not that I'm aware of for iOS 16. There are some sites that crashed iPhones in much older versions, but Apple was relatively quick at fixing those security holes. Now, Apple can simply push out security fixes without the need for a full software update.

Lockdown Mode is a higher level of protection designed for the very few people who may be personally targeted by some of the most sophisticated digital threats due to who they are or what they do. For the general population, it is not necessary. You're not planning on running for a political office by chance, are you?

Thanks for your input, could you also give me your thoughts on my other reply to you.

And I am not politically involved, just trying to protect my assets,
Thanks again.

 

[9138988]

Not that I'm aware of for iOS 16. There are some sites that crashed iPhones in much older versions, but Apple was relatively quick at fixing those security holes. Now, Apple can simply push out security fixes without the need for a full software update.

Lockdown Mode is a higher level of protection designed for the very few people who may be personally targeted by some of the most sophisticated digital threats due to who they are or what they do. For the general population, it is not necessary. You're not planning on running for a political office by chance, are you?

Hey, just wanted to give you an update on my situation, so I checked my APP Network Activity under App Privacy Report in IOS Settings, and it showed the NSFW website that was opened with the in-app browser in reddit, and it also shows a bunch of domains that the website connected to, I scanned the urls of all of the domains that the eebsite connected to and they all seem non-mickous according to virustotal.com.

One thing that concerns me is that the website network activity says I visited the website inquestion: (v3.redgifs.com) over 20 times, when I only visited it that one time via the in-reddit browser. Why would it show twenty visits if that was not the case, is this just a glitch?

Additionally, I also sent the link to someone in imessages when I was describing what was going on to a friend, and apparently that also caused the link to open in the background because when you send a link it opens a link preview on the senders and receipents device, and this showed up in app network activity aswell.

So I basically opened this link (v3.redgifs.com) in three different locations,

through a reddit preview with the in-app safari,

through imessages because i sent the link to another person which generated the preview

and through safari when i was panicking as i looked up the website again

Can any of these three actions result in device compromise?

And why does the app network activity section in Iphone settings say I opened this link 20 times when Im 100% sure I didn’t. Could this be a glitch?

Thank you so much for all of your help so far.

 

[severi]

It would be possible for a hacker to bypass any sandbox and pretty much every security feature of Safari (zero day vulnerabilities). But it is extremely unlikely that they would burn security vulnerabilities of this class on random people online (this could maybe happen in targeted attacks on politicians or otherwise important people). These vulnerabilities are immensely valuable and can often be sold for millions of dollars. Most of the times they’re being reported to Apple directly for a lot of money: https://security.apple.com/bounty/categories/

So i wouldn’t worry too much about it. This was just a website utilizing JavaScript‘s window.alert feature.

 

[9138988]

It would be possible for a hacker to bypass any sandbox and pretty much every security feature of Safari (zero day vulnerabilities). But it is extremely unlikely that they would burn security vulnerabilities of this class on random people online (this could maybe happen in targeted attacks on politicians or otherwise important people). These vulnerabilities are immensely valuable and can often be sold for millions of dollars. Most of the times they’re being reported to Apple directly for a lot of money: https://security.apple.com/bounty/categories/

So i wouldn’t worry too much about it. This was just a website utilizing JavaScript‘s window.alert feature.

Hey, so what do you mean by a website utilizing JavaScripts window alert features? When I checked my web app privacy report it said I visited the website over twenty times, but I only did it twice therefore do you think that only means it had something to do with how it got processed upon opening it ?

Also, would it be like targeted if a attack like this was carried out? It cant just happen clicking random nfsw links right?

Just to clarify, it was a v3.redgifs.com link, I did some research and it is a legitimate NSFW content website thats widely known, but I just got a bit worried after that incident when I clicked a video on reddit that I thought was just a video not a redirect to an offapp website.

 

[9138988]

In-App Browsers are a feature of Safari so the same security features remain. The app itself does not have access to potentially sensitive user data nor can it change anything outside of its controller, only the app itself. Furthermore, the JavaScript environment is not accessible from the main app, and SSL certificates cannot be bypassed making it pretty trustworthy.

If you're still worried, you can also clear your website data from Settings > Safari. Most likely, that site's cache is not even there.

Hey, just to follow up, my phone also processed the link another time when I sent the link to a friend when I was discussing what happened, I didn’t realize it would make my phone open the link again in the background when sending a link to another individual.

I checked web app reports and it showed that the link got visited again via message's, because of when I sent this preview, was it still sandboxed and protected when my phone viewed the website again via the generated link preview in Imessages like the first time with the in - app reddit browser?

Thanks for all of the clarification so far.

 

[severi]

Hey, so what do you mean by a website utilizing JavaScripts window alert features?

Websites can just send you alerts on page load and they show up natively.