Criminals Successfully Extort Safari Browser Users Watching Adult Content

The saying “internet is for porn” proves to be quite correct in some cases. Ransomware scammers recently exploited a bug found in Apple’s Mobile Safari browser to extort fees from people who partook in viewing porn on their devices. Although the vulnerability has been patched since, it goes to show mobile browsing habits can lead to a lot of trouble down the line.

Viewing Porn In Safari Leads To Extortion

As it turns out, Apple’s Mobile Safari browser suffered from a bug that could have affected all users around the world. The browser displays JavaScript popups, yet a flaw in the way these requests are being handled allowed criminals to take advantage. To be more specific, they could plant exploit code on multiple [adult] websites to cause an endless loop of windows to be displayed in the browser. As a result, Safari becomes completely unusable, which is not something one wants to deal with.

This exploit allowed criminals to pose as law enforcement agencies. Through this loop of popup windows, the hackers claimed users had to pay a ransom to regain control over the Safari browser. Unlike what one would expect this ransom was not paid in bitcoin, but rather in the form of iTunes gift cards. These codes are globally available and 100% anonymous, making them perfectly suited for nefarious online activity.

This iTunes gift card code had to be sent in the form of a text message to a random mobile phone number. A lot of people fell for this trick, even though there was a more than viable alternative solution available that did not require paying the ransom. Instead, going into the device settings and clearing the browser cache would have the same effect. Some less tech-savvy people may not have known about his trick, which is why they paid the ransom in iTunes gift cards. They got caught with their pants down, so to speak.

Using fear as a factor to demand a ransom from victims is nothing new these days. Earlier versions of ransomware software disguised themselves as messages sent by local police officials, warning the user about illegal activity on the internet. Said victims also had to pay a ransom to criminals to get rid of the message. During times like this, a lot of people are too embarrassed to ask for outside help and they see no other option than to meet the criminals’ demand.

Thankfully, it is no longer possible for criminals to take advantage of this JavaScript-related bug in the Safari browser. Apple released iOS 10.3 earlier this week, which addresses this problem and various smaller bugs and tweaks. It is good to see the technology giant taking notice of this problem and offering a solution so quickly. Anyone who has not updated their mobile IOS device to the latest firmware should do so as soon as possible.

Security researchers believe this attack is derived from a  similar attack actor used against Android device owners back in 2014. That particular campaign revolved around forcing users to pay a US$300 ransom using Paysafecard or uKash, otherwise they would be investigated by the police for “consuming illegal pornography”. It is unclear if this iOS exploit is developed by the same people, though.

If you liked this article, follow us on Twitter @themerklenews and make sure to subscribe to our newsletter to receive the latest bitcoin, cryptocurrency, and technology news.