1

On two separate devices (Android and Windows 7, Opera and Firefox, logged in and logged out) on two separate internet connections, I'm getting pop-ups and pop-unders (this page opened in a new tab, old tab redirected) to spammy sites from at least three different SE sites including this one any time I click on anything on the home page; mobile and desktop sites.

I've had this all day (26th October 2016), haven't seen it before. Seems to be only homepages.

Nothing on any other sites on the same devices, only SE.

But I can't see anything about a problem affecting anyone else. Could it be just me, somehow? I can't see any common factor other than SE.

Here's what the Travel.SE homepage HTML looks like for me. URL is correct, but this doesn't look right at all, it looks like something has compromised it somehow:

enter image description here

And here's the URL that shows if I mouseover the 'Ask' button:

enter image description here

If this is somehow only affecting me, somehow on both my separate devices at once, somehow only affecting SE, can anyone suggest what could possibly be the cause and what I can do about it?


Edit: just had the same thing on this question page after posting it. Ask and edit form pages seem to be unaffected however. Here's what Opera's inspect looks like for this question page for me which triggered two blocked popups and a popunder to a dodgy "make your computer faster" type spam page:

enter image description here

...okay, this page isn't clean either, the preview looks like this:

enter image description here

closed as off-topic by user568458, Nathan Tuggy, Werner, Ben N, Ward Oct 26 '16 at 3:55

This question appears to be off-topic. The users who voted to close gave these specific reasons:

  • "The problem described here can no longer be reproduced. Changes to the system or to the circumstances affecting the asker have rendered it obsolete. If you encounter a similar problem, please post a new question." – Werner, Ben N, Ward
  • "This question does not appear to be about the software that powers the Stack Exchange network, within the scope defined in the help center." – user568458, Nathan Tuggy
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Well the obvious answer is malware (a quick search for one of the dodgy looking scripts shows it probably is) – Cai Oct 25 '16 at 23:33
  • Not sure how I could have got similar malware on Android and Windows devices at the same time, but I'm doing a scan in case. The weird HTML in the SE pages seems to disappear if I use HTTPS, and using my phone's 3G connection seems to actually avoid it too (earlier I'm sure I was having the same problems over 3G but maybe it was pages that already loaded using WIFI). I'm in a hotel, I'm wondering if maybe the hotel WIFI is altering the page over HTTP but not over HTTPS somehow? Not sure if that's even possible? – user568458 Oct 25 '16 at 23:39
  • 2
    Altering pages served over HTTP is very much possible, that's why we have HTTPS. :) If you're at a hotel, my money is definitely on the hotel network being dodgy on purpose at best and infected at worst. Maybe avoid the wifi altogether just to be safe. – Adam Lear Oct 25 '16 at 23:41
  • Yup, after some more testing, it's definitely only on SE pages served using the hotel WIFI over HTTPS. Weirdly other http pages seem fine (e.g. no similar problems on BBC pages). I've voted to close, since it is just me, and I'll have a word with the hotel staff in the morning... – user568458 Oct 25 '16 at 23:46
  • Their routers are HAUNTED! Booooooo! Spoooooky! – Won't Oct 26 '16 at 13:48
2

It seems it was just me and was a product of a dodgy hotel WIFI connection, as confirmed by the following steps:

  • Problem disappears when accessing SE using HTTPS e.g. https://meta.stackexchange.com
  • When I observed the problem on my phone connected using 3G, it appears to have been a page that had earlier loaded using WIFI and was being accessed from memory. After closing all tabs and reloading using 3G, I saw no problem regardless of whether HTTP or HTTPS was used.

Since it's not an SE problem, as well as leaving these diagnostic steps here for anyone facing a similar problem, I'm voting to close.


Update - I've started seeing it happen when using a 3G connection again even after reloading the page, but this stopped after I cleared the browser cache, suggesting something like maybe the dodgy Wi-Fi modified one of the genuine js files then my browser (Chrome for Android) cached the modified version.

Not the answer you're looking for? Browse other questions tagged .