Drive by download attacks specifically refer to malicious programs that are installed on your devices without permission. Also, these attacks include the unwanted download of any file or software on your computer. These attacks are hidden all over the web.

Drive by Download attacks are classified into two main categories, which are:

Software or programs that are not inherently malicious (PUPs/PUA)

Malware-based attacks

The first option is quite obvious and may at worst be an adware itself. Cyber ​​security experts use the latter as the definition of drive by download.

What is a Drive by Download attack?

drive by download refers to the unintended download of malicious code to a computer or mobile device that exposes you to a cyber attack. You don’t have to click on a link or open a malicious email attachment to get infected.

Drive by download can exploit security flaws in applications, operating systems, or browsers caused by failed or missing updates. Unlike many other types of cyber attacks, drive by downloads do not rely on the user to activate and execute the attack. Drive by downloads are designed to infiltrate your device for one or more of the following reasons:

Steal your device – to build a botnet, infect other devices, or further infiltrate.

Spy on your activity – to steal account information, financial information or your identity.

Destroying data or disabling your device – simply causing you trouble or personal harm.

Without proper security software or vulnerability patching, you may become a victim of a Drive by Download attack.

How do Drive by Download attacks work?

If you’ve ever asked yourself, “What is a drive by download attack?”, you know more than anyone else. Since these attacks penetrate slowly, even on secure sites, most people have no idea how they got infected. There are two main ways that malicious drive by download files can get into your device:

Giving access without knowing the consequences: You take an action that leads to infection, such as clicking a link in a fake security alert or downloading a Trojan.

Full access without any notification: You visit a site and get infected without any request or action. These downloads can be done anywhere, even reputable sites.

Knowing exactly what a drive by download is is just as important as knowing how it selects prey to attack. In the following, each of these methods is examined in more detail to help you find possible risks.

Authorized downloads with hidden files

drive by download is allowed, simple and even possible to see before the attack:

• The hacker creates a path to upload malware – online messaging, advertisements, downloading legitimate programs.
• You take a certain route – clicking on a deceptive link, downloading software, etc.
• Malware is installed on your device – with no option to opt out of installing additional software or connecting to a malware-infected site.
• The hacker successfully enters your device – the malware takes control of your data.

Software or websites may look harmless but be infected by malware. In fact, one of the biggest dangers is the easy lure of visitors to sites or apps that look safe but aren’t. For example, you might be emailed a link or receive a post on your social media feed that looks like it’s from a reputable source you trust. This social engineering tactic is used to get you to click and open the link. After opening the website, drive by download will be installed on your computer or mobile device.

Bundleware is a popular “access” method that uses secondary programs to connect to your main software. These potentially unwanted programs (PUPs/PUAs), sometimes called barnacles, can hide malware or be malware themselves. You’ll usually see bundleware as an opt-out alternative when downloading freeware or subscription software.

Phishing can also be used as bait for drive by download. Popups or fake online messages appear from organizations you know and trust. You may see a fake security breach notification in your browser or receive a fake data breach email from your bank.

Unauthorized downloads without your knowledge

Despite having several phases, an unauthorized drive by download works in a simple way:

• A hacker creates a malicious web page – creates a malicious component with a security flaw.
• You activate the component – when you visit the page, it finds security holes in your device.
• This component downloads malware to your device – it does so through a security flaw in your device.
• Malware does its job – it allows a hacker to disrupt, control or steal your device.

As mentioned above, unauthorized malicious code is distributed directly by compromised websites. However, the code is placed in the desired location by the hackers. Their methods of operation rely on common digital technology flaws as well as security issues.

Exploit kits are software used to compromise vulnerable web servers and your devices. These kits detect software vulnerabilities in machines and web browsers to determine which systems are easy to hack. Exploit kits often use small pieces of code to bypass simple security measures with minimal attention. The code focuses on one simple task: connecting to another computer to receive the rest of the codes needed to access the mobile device or computer.

Security vulnerabilities discovered by exploit kits are inevitable in the digital age. No software or hardware can ever be perfect. Just like a building can be penetrated with careful study and planning, the same can be true for software, networks, or other digital infrastructure. Vulnerabilities come in several common forms:

Zero-day attacks: security flaws with no known solution until then.

Known Attacks: Security issues that are known but the solution has been removed.

Zero-day attacks are hard to avoid, but known attacks are carried out simply because of poor security measures. If users and administrators fail to update all their software on time, they miss out on critical security updates. This is what hackers are looking for.

Preventing Drive by downloads attacks is one of the most difficult tasks. Without adequate attention to detail and strong security at all points, being on the web becomes much more dangerous.

How to prevent Drive by downloads attacks

As with many aspects of cyber security, the best defense is caution. You should never take your safety for granted. Below are some of the best guidelines to avoid downloading malicious codes.

How website owners can prevent Drive by downloads

As a website owner, you are the first line of defense against hackers targeting your users. To give yourself and your users peace of mind, strengthen your infrastructure with the following tips:

Keep all website components up to date. These updates include templates, plugins or other infrastructure. Each update is likely to have new security fixes to prevent hackers from entering.

Remove outdated or unsupported components from your website. Without regular security patches, outdated software is perfect for abuse and fraud.

Use strong passwords and usernames for your admin accounts. Brute force allows hackers to easily break into sites that use default passwords or weak passwords like “password1234”. Use a password generator along with a password management tool to stay safe.

Install a web security software on your site. Monitoring software helps you to watch out for malicious changes in your site’s code.

Check how the use of ads affects users. Advertising is a popular way to drive by downloads. Make sure your users don’t receive suspicious ads.

7 tips for end users

As a user, you have to rely more on the security features of your software. You can follow these tips to prepare yourself and your software against Drive by downloads attack:

Only use the main administrator account of your computer to install the program. Management approval is necessary to install Drive by downloads. Since this is approved by default on your primary account, use a secondary account without administrative access for day-to-day use.

Keep your web browser and operating system up to date. The new patches will help to seal the security holes where the Drive by downloads codes can penetrate. Don’t delay updates and install them as soon as they are released.

Don’t keep unnecessary software and programs too much. The more plugins you have on your device, the more susceptible you are to being hacked. Keep only the software you trust and use often. Also, remove older software that no longer receives updates.

Use one internet security software on all your devices. Internet security software automatically updates malware definitions to identify the latest threats. They can also continuously scan websites to block infected sites.

Always avoid websites that may contain malicious code. Sites that offer file sharing or adult content are common points of infection. Only visit common sites that you usually use, or at least reputable sites, to reduce the chance of getting infected.

Read and check the popups carefully before clicking. Fraudsters use deceptive popups on desktop and mobile browsers that look like regular alerts. Check for typos, weird grammar, and suspicious images to avoid connecting to a malicious site.

Use an ad-blocker. Drive by downloads attacks often use online advertisements to upload malicious code. Using an ad blocker will help you be less exposed to such risks.