2022's best place for Cybersecurity Insights and Advice for Everyone

#1 - Signup to our list and get regular insights and advice on how to be cyber safe.

By entering your email address you agree to receive emails from EveryDayCyber. We'll respect your privacy and you can unsubscribe at any time.

What is a Drive By Download?

by Cyberguy | Last Updated | November 30, 2021
Cyber Dictionary|CyberSecurity - Consumer

Hit by a “Drive by Download”

The days of having to click on something to get infected with malware (malicious software) are long gone. Now just going to a website can result in your device getting infected. Pretty scary stuff actually.

Drive by download example

Cybercriminals, bad actors, black hat hackers – whatever term you want to use, are nasty folks. But they are sophisticated, cunning, innovative and they are constantly finding new ways to cause chaos, scam us and get their nasty little fingers into our devices and our digital lives.  Drive by downloads is just one of many techniques and methods they use and it is one that many folks, like you and me, could get burned by if we are not careful.

So, what exactly is a “drive by download”?

A “drive by download” occurs when you visit bad actor websites or open apps that were specifically built to do “drive by” infections or, as in some cases, on legitimate sites or in well-known apps where bad actors have injected their malicious code to cause a hidden download to occur. All of this without your knowledge and definitely without your permission.

The simple act of visiting a website that has this capability or opening an app that you thought was safe but isn’t, can result in a “drive by download”. Typically, the malware that is downloaded as part of the “drive by” process is small (again so it is difficult to notice) and once it’s on your device it then executes its primary role which is to download the really bad stuff – virus, worm, trojan horse, bot, etc., etc.  So, in most instances, the “drive-by” is a 2-step process. But regardless of the number of steps, the results are all the same – bad news.

When compared to other forms of malware, “drive-byes” are truly challenging because the bad actors didn’t have to entice you to act. Most often the decision to visit a website or download/open an app (engineered for “drive-by downloads”) is a user choice and this makes it even more difficult to avoid because humans like to venture – to new websites and new and cool apps.  Unfortunately, in many ways, we are doing a lot of the leg work for the cybercriminals.

#2 So here we are at the middle of the post. We still think it's a good idea to signup.

By entering your email address you agree to receive emails from EveryDayCyber. We'll respect your privacy and you can unsubscribe at any time.

So, how is this possible?

As previously mentioned, the hackers are smart, evil yes – but smart. They spend a lot of time looking for vulnerabilities in apps, operating systems, and web browsers and when they find security flaws, they exploit them and they do it very quickly. They particularly take advantage of these types of vulnerabilities in tools that we all use every day, like web browsers. Because everyone browses the internet, web browsers are a primo target and are constantly being hacked because the bad actors know everyone uses them.

How do they actually work?

“Drive by downloads” are typically designed to exploit vulnerabilities in apps, operating systems, and web browsers that have not been patched by users. Often there are patches available, but users (including me) tend to be lazy about keeping their software updated and the bad actors know this, so they build “drive-byes” to hit those users who don’t patch their devices.

In those instances, the drive-byes are typically designed to breach your device in the following ways:

  1. Hijacking — to build a botnet, infect other devices, or breach your device further.
  2. Spying – to steal your online credentials, financial info, or identity.
  3. Trash your device – to simply cause trouble or intentionally harm you.

How a drive by download works

Drive by downloads occur in one of two ways:

  1. Unknowingly Authorized: You take an action leading to infection, such as clicking a link on a deceptive fake security alert or downloading a Trojan that is part of an app you believed to be legitimate.
  2. Totally Unauthorized: You visit a site and get infected simply by opening the site. These downloads can be anywhere, even legitimate sites.

Knowing exactly what the types of “drive-byes” is as important as knowing how the enticements work for such an attack.

Here are some methods to help you see possible red flags.

Unknowingly Authorized

Authorized drive by downloads are streamlined and may even be spotted before the attack:

Software (particularly those presented as free) or websites may seem innocuous, but they can be corrupted by malware.

Totally Unauthorized

Unauthorized “drive-byes” are fairly basic despite having multiple phases:

  1. Bad Actor compromises a web page— deploys malicious element via a security flaw.
  2. You trigger the malicious element — visiting the page and it finds your device’s security gaps.
  3. The element downloads malware to your device— via the security vulnerability.
  4. Malware executes — enabling the bad actor to disrupt, control, or steal from your device.

Unauthorized malicious code is delivered directly by compromised websites. The code is placed there by bad actors. They rely on flaws of digital technology and unsafe security.

How to avoid being hit by a drive-by?

As with many aspects of cyber safety, the best defense is common sense, active cyber hygiene and never take your digital security for granted.

  1. Make sure your web browser and operating system are up to date.
    Many patches seal gaps where drive-by-download code could burrow in. Do not delay and install these updates as soon as they are released.
  2. Use your device’s admin account for software installs.
    Since Admin privileges are necessary for “drive-by” downloads to install without your consent. Use a secondary non-admin account for daily use like browsing, this will restrict the possibility of an unwanted download/install.
  3. Keep your programs and apps to only those necessary.
    Only keep the software you trust and use regularly. Eliminate older apps that no longer receive updates. The more apps and plug-ins you have on your device, the more susceptible you are to infection.
  4. Use highly quality antivirus/antimalware solutions on all your devices.
    Quality tools automatically keep your malware definitions up-to-date to spot the latest threats. They scan websites proactively to block all known compromised sites.
  5. Avoid sites known for malicious code.
    File-sharing or Adult content sites are common points of infection. Only use well-established sites to improve your chances of staying clean.
  6. Review and double-check security popups before clicking.
    Check twice, click one” – bad actors use deceptive popup ads on browsers that look like legitimate alerts. Look for typos, odd grammar, and grainy images – these are indicators of a scam.
  7. Get an ad-blocker.
    Drive-by attackers use online ads to upload infections. An ad blocker can help reduce your exposure to this type of attack.

How to avoid a drive by download

#3 You really should sign up. "Scouts Promise" ... it really will help you stay cyber safe.

By entering your email address you agree to receive emails from EveryDayCyber. We'll respect your privacy and you can unsubscribe at any time.