Pop-up scam

[Watis]

I've just had a pop-up message while browsing TLF on my Android phone which was an obvious scam saying that my bank account needed me to log in, etc.

It appeared in the centre of the screen, with the rest of the display shadowed out, until I chose 'cancel', the only other choice being 'update' or similar.

Whilst it may be nothing to do with TLF, it did overlay the screen in the same way that the full screen adverts do.

I run Avast! antivirus software on this phone.

Has anyone else seen this sort of behaviour?

Watis

[AleisterCrowley]

I get loads of mid screen/background blurred out ads on TLF - just the usual stuff rather than scams

[Watis]

What was different about this one was that it arrived the way it did - more like a system message and definitely not like a text message.

Since my OP, I've installed Malwarebytes, which is now scanning the whole phone. It's going to take hours so I'll report back when it's finished.

Watis

[Infrasonic]

Which browser?

[Watis]

Which browser?

Chrome

[Infrasonic]

Which browser?

Chrome

Go into settings and click on Javascript (allowed is default), click on add site exception and add the TLF site address www.lemonfool.co.uk, which will block JS.
See if that stops the ad/malware hijack.
Pop ups and redirects should be blocked by default, but it's worth checking that also.

[Watis]

Which browser?

Chrome

Go into settings and click on Javascript (allowed is default), click on add site exception and add the TLF site address http://www.lemonfool.co.uk, which will block JS.
See if that stops the ad/malware hijack.
Pop ups and redirects should be blocked by default, but it's worth checking that also.

Thank you, Infrasonic. I've added the TLF website as you suggested. Pop-ups and redirects are blocked.

Malwarebytes found no malware.

Watis

[Infrasonic]

Chrome

Go into settings and click on Javascript (allowed is default), click on add site exception and add the TLF site address http://www.lemonfool.co.uk, which will block JS.
See if that stops the ad/malware hijack.
Pop ups and redirects should be blocked by default, but it's worth checking that also.

Thank you, Infrasonic. I've added the TLF website as you suggested. Pop-ups and redirects are blocked.

Malwarebytes found no malware.

Watis

Some more basic sites work fine without JavaScript enabled - but many eCommerce, banking et al sites won't - so it's best to leave it on and add exceptions as needed.
Unfortunately many nasties use JS also...

[Watis]

On going back to amend the Javascript exception to add the full URL, I find that it won't accept http addresses, only https ones.

I had previously entered just 'lemonfool.co.uk' and, as this was accepted, will revert to that.

Watis

[Infrasonic]

On going back to amend the Javascript exception to add the full URL, I find that it won't accept http addresses, only https ones.

I had previously entered just 'lemonfool.co.uk' and, as this was accepted, will revert to that.

Watis

It should be blocking the TLF site ads.

[Watis]

On going back to amend the Javascript exception to add the full URL, I find that it won't accept http addresses, only https ones.

I had previously entered just 'lemonfool.co.uk' and, as this was accepted, will revert to that.

Watis

It should be blocking the TLF site ads.

No, I'm still seeing ads...

And this after clearing cookies, etc. so I had to log in again.

Watis

[Infrasonic]

On going back to amend the Javascript exception to add the full URL, I find that it won't accept http addresses, only https ones.

I had previously entered just 'lemonfool.co.uk' and, as this was accepted, will revert to that.

Watis

It should be blocking the TLF site ads.

No, I'm still seeing ads...

And this after clearing cookies, etc. so I had to log in again.

Watis

Try www.lemonfool.co.uk (I had to put that in to get it block successfully when testing before).

[Infrasonic]

Another trick is to go to chrome://flags and enable Reader Mode Triggering - I have it switched to always and then it is an option on most sites.
That will strip out ads, JS and other stuff so you are just left with text - handy for news sites that light up like Blackpool illuminations otherwise and take ages to load...

[Watis]

It should be blocking the TLF site ads.

No, I'm still seeing ads...

And this after clearing cookies, etc. so I had to log in again.

Watis

Try http://www.lemonfool.co.uk (I had to put that in to get it block successfully when testing before).

Thank you, Infrasonic. That has worked.

Watis

[Watis]

Another trick is to go to chrome://flags and enable Reader Mode Triggering - I have it switched to always and then it is an option on most sites.
That will strip out ads, JS and other stuff so you are just left with text - handy for news sites that light up like Blackpool illuminations otherwise and take ages to load...

I'll check that out, too.

Thanks again,

Watis

[UncleEbenezer]

Some more basic sites work fine without JavaScript enabled - but many eCommerce, banking et al sites won't - so it's best to leave it on and add exceptions as needed.

Safety first[1]. Disable it in general, then enable it for a site only when you want something that requires it.

[1] Though the most obvious improvement is the number of annoyances it saves you.

[Infrasonic]

Some more basic sites work fine without JavaScript enabled - but many eCommerce, banking et al sites won't - so it's best to leave it on and add exceptions as needed.

Safety first[1]. Disable it in general, then enable it for a site only when you want something that requires it.

[1] Though the most obvious improvement is the number of annoyances it saves you.

Been there done that years ago, makes many sites unuseable - which is why browsers have JS switched on by default and recommend you leave it that way as something like 90% + of all websites use it...
Likewise blocking first party cookies and amping up things like anti fingerprinting / tracking filters. Again you'll get warnings that sites will be broken on the highest settings. Tried it, sites got broken, so I run those things on medium. Third party cookies are blocked globally and allow listed where needed, although plans are afoot via Google to get rid of third party cookies completely...

[AF62]

Has anyone else seen this sort of behaviour?

No because I block adverts on all my devices, PC, iPhone, iPad, and even the TV.

For Android there are a number of routes you could take; an ad-blocking browser instead of Chrome, a VPN to a Raspberry Pi running pihole (or setting the DNS to route to the pihole when using WiFi at home), a commercial VPN or DNS which blocks adverts, etc.

[mutantpoodle]

has anyone found a 'pop up blocker' that stops the constant pop ups demanding that you accept ALL cookies unless you read reams of options and delete by ticking boxes??

I automatically leave each of those sites even if it means I miss content I was looking for

[Infrasonic]

has anyone found a 'pop up blocker' that stops the constant pop ups demanding that you accept ALL cookies unless you read reams of options and delete by ticking boxes??

I automatically leave each of those sites even if it means I miss content I was looking for

Those are a regulatory requirement - GDPR - so no.
There are plans for future updates to browsers to offer an automatic response to GDPR cookie requests e.g block all except first party or variations thereof chosen by the user - but it could get complicated because of all the variables - so we'll have to see how effective it is in practise.

Cookies themselves are going to be phased out at some point to be replaced with something less invasive (from a privacy perspective) - but whatever form it takes will still need to report back certain information for operational purposes, so won't be truly anonymous by any stretch.