Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Many security experts advise not to click on malicious URLs. How can clicking a URL affect a computer's security?

If a malicious file was downloaded and executed, then a computer's security may be breached, but how can just visiting a URL do this?

share|improve this question

2 Answers 2

up vote 8 down vote accepted

You can be infected via the use of what is called a drive-by-download exploit. This is how malware can download and install itself on your machine simply by loading a web page that contains it.

It works by finding vulnerabilities that allow it to escape whatever sandboxes it is supposed to be playing in, and execute arbitrary, malicious code on your machine.

Years ago, when early versions of Internet Explorer were the most popular browsers on the web, ActiveX components were the most popular vectors for drive-by-downloads. Presently, other drive-by download vectors appeared such as with Flash Player plugins, Java applets, or PDF and images. In all case, JavaScript is the primary vector that, if used properly by a miscreant, can lead to a drive-by download attacks such as the attack on Firefox that was used to expose personally identifying data for some Tor users.

share|improve this answer
    
so what happens is, a malicious code segment finds a bug in my browser and enters into my computer through it? –  DesirePRG Aug 23 '13 at 18:24
2  
@DesirePRG Yes, essentially, but it's more likely to be a bug in a plug-in such as the Adobe Flash player, or the Java JRE, than in the browser itself. –  Xander Aug 23 '13 at 18:26
    
great! Thank you for the explanation –  DesirePRG Aug 23 '13 at 18:29

It could be part of a Cross Site Reqest Forgery (CSRF) attack which isn't so much an attack on the users computer but an attack on their web application accounts. Say you have an account on CrappyBank.com's website and they are not protecting against CSRF attacks. If CrappyBank uses the following to transfer funds:

http://CrappyBank.com/transfer?dest=otherAccount&amount=100

A malicious link could look like this:

<a href="http://CrappyBank.com/transfer?dest=HackerAccount&amount=1000">
     Click me!!!
</a>

And if you were logged in to your bank account at the time, you would inadvertently be transferring funds to the malicious users account.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.