What are Drive-by Downloads?

The Rise of Drive-by Downloads: How Cybercriminals Use Social Engineering to Spread Malware

Drive-by downloads are a common method of spreading malware and a significant issue in the field of cybersecurity. Derived from 'drive-by shooting,' the term perfectly describes the action — a malware delivery method by which unwanted software covertly installs itself without a user's knowledge or direct interaction.

Drive-by downloads function by exploiting vulnerabilities in internet-facing applications, most commonly web browsers. Users may be surfing the web as normal and accidentally stumble upon a website that has been infected with malicious scripts. These scripts immediately and quietly exploit known or undisclosed vulnerabilities in the users' browser software or in the plug-in applications running within the browser's environment.

The user doesn't need to download a file or agree to install software to become a victim of a drive-by download. As long as they're on an infected site with a vulnerable browser, the download is triggered quietly in the background. It is perhaps one of the most devious ways of spreading malware, precisely because it requires nothing from the user except their innocent browsing activity and an unpatched software vulnerability that they might not even be aware of.

The downloaded malware can be a wide variety of malicious software. From adware that fills up your screen with unauthorized advertisements, to software that tracks your browsing and keyboard inputs, to ransomware that locks you out of your entire system until you pay a ransom. More often than not, the malware aims at using the unsuspecting user’s computer for malicious purposes, such as joining a botnet, becoming part of a Distributed Denial of Service (DDoS) attack, or spreading more malware to others.

Consider instances of Equifax data breach or the dreaded Wannacry worm; both were capable of initiating drive-by downloads, exploiting known vulnerabilities, and causing massive damage – both economic and otherwise. Web servers that host such malicious content often belong to legitimate owners but they are also victims - their servers are taken over by cyber criminals that plant the malicious scripts.

Antivirus software plays an important role in countering drive-by downloads. These sophisticated software ports typically have detection tiers built in to hit at different layers of potential vulnerability. They actively monitor internet activity, checking the security of sites users visit; they run real-time checks on downloads, screening for known malware or suspicious file construction; and they even periodically check the state of the system itself, looking for signs of unauthorized or malicious changes.

Antivirus provides daily updates to tackle the most recent threats to keep systems up-to-date and protected against continually evolving malware. This continual update process, called heuristic analysis, effectively learns from new malware and updates detection protocols accordingly. By spotting the warning signs of potential intrusion, the antivirus software curtails the malware from finding a foothold.

Also, regular updates to your browser and its plugins add another layer of security, as many drive-by downloads exploit known but unpatched vulnerabilities found within stunningly popular software such as Adobe Flash Player, Java, or Microsoft Silverlight. Updated versions usually provide fixes for these vulnerabilities, thus preventing exploitation.

Drive-by downloads are a significant and devastating threat to cybersecurity. Preventing them requires diligence, both from the web surfers who should keep their software updated and use effective antivirus tools, and the web professionals who work behind the scenes to design, patch, and secure the browsers, plugins, and sites over which the internet-connected world connects. The continuous fight against drive-by downloads testifies to the evolving nature of our digital world and our efforts to make that world safe and trusted.

Drive-by Downloads FAQs