Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Many security experts advise not to click on malicious URLs. How can clicking a URL affect a computer's security?

If a malicious file was downloaded and executed, then a computer's security may be breached, but how can just visiting a URL do this?

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

You can be infected via the use of what is called a drive-by-download exploit. This is what we can malware that can download and install itself on your machine simply by loading a web page that contains it.

It works by finding vulnerabilities that allow it to escape whatever sandboxes it is supposed to be playing in, and execute arbitrary, malicious code on your machine.

Years ago, when early versions of Internet Explorer were the most popular browsers on the web, ActiveX components were the most popular tools for drive-by-downloads. Lately, it's generally been malicious Flash movies, Java applets, or PDF documents that take advantage of vulnerabilities in Adobe Acrobat Reader. Even JavaScript can be a vector. This is rare, but one was recently used to exploit a vulnerability in Firefox to expose identifying details of Tor users.

share|improve this answer
    
so what happens is, a malicious code segment finds a bug in my browser and enters into my computer through it? –  DesirePRG Aug 23 '13 at 18:24
2  
@DesirePRG Yes, essentially, but it's more likely to be a bug in a plug-in such as the Adobe Flash player, or the Java JRE, than in the browser itself. –  Xander Aug 23 '13 at 18:26
    
great! Thank you for the explanation –  DesirePRG Aug 23 '13 at 18:29
add comment

It could be part of a Cross Site Reqest Forgery (CSRF) attack which isn't so much an attack on the users computer but an attack on their web application accounts. Say you have an account on CrappyBank.com's website and they are not protecting against CSRF attacks. If CrappyBank uses the following to transfer funds:

http://CrappyBank.com/transfer?dest=otherAccount&amount=100

A malicious link could look like this:

<a href="http://CrappyBank.com/transfer?dest=HackerAccount&amount=1000">
     Click me!!!
</a>

And if you were logged in to your bank account at the time, you would inadvertently be transferring funds to the malicious users account.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.