Advertisement suddenly appearing on top of almost every page

Solution 1:

After many tests, I've realized that the problem is happening on cellular network only because of caching. After clearing a cache (Clear History and Website Data) and refreshing, the problem went away. And it reappeared only after connecting back to the Wi-Fi.

This made it obvious that the problem is due to a compromised router, Edimax AR-7265WNB. Resetting the router back to the factory settings and re-configuring fixed the problem.

I did not find newer version of router firmware than the one I have (FwVer:3.10.16.0_TC3085 HwVer:T14.F7_3.0). Though I've found that the firewall on the router was off. Actually the router reset itself few weeks back. When reconfiguring it, I probably forgot to enable the firewall (actually I would expect the firewall to be on by default).

The problem seems world-wide now (other reports here and here, some other were deleted), contrary to my claim in the question. That would suggest remote exploiting of some router vulnerability (supported by firewall issue), rather than local hacking into Wi-Fi. The others report different types of router (D-Link DSL-2600U, TP-Link), so the issue is not specific to the Edimax.

The other reports mention that a DNS or proxy settings was modified. I did not checked this before resetting my router. But it is possible that my router was modified this way, as the firewall was off. Also it explains injecting code in any page without a need for any router-specific exploit. So the attacker possibly scans internet for any unsecured routers and simply configures them to point to attacker's proxy.

Solution 2:

I noticed about 2 days ago I was getting the exact same ads across multiple devices (laptop, android smartphone and Nexus 7). When I clear all the browser caches and connect to a cellular network the ads stop, but once I connect to the wi-fi they come back.

I ended up switching the DNS server on all of my connections to google's 8.8.8.8 and the ads stopped coming back on every device.

So either the router or the ISP's DNS server is compromised is my best guess.

edit: Same as How can I remove unwanted ads on top of sites?