If so, how? Currently working on a spam filter for a large company and trying to determine the level of risk involved with this. We run many different Windows versions.
This CNN video seems to imply that it is possible, but my understanding is that you have to convince a user to download a file and attempt to open it before the code to take control of the computer would run:
http://money.cnn.com/video/technology/2015/12/06/hackers-social-engineering.cnnmoney/
From Comodo.com's newsletter:
A 'drive-by-download' attack is a malware delivery technique that is triggered simply because the user visited a website. Traditionally, malware was only 'activated' as a result of the user proactively opening an infected file (for example, opening an email attachment or double clicking on an executable that had been downloaded from the Internet).
Unfortunately, hackers have become much more sophisticated over recent years and this level of interaction is no longer required. Malware may be served as hidden codes within a website content, served content like banners, advertisements and used as a vehicle for hacking and other cyber-crime. The simple act of visiting a site is enough to get your computer infected or your personal details stolen.
Yes, using any browser exploit. https://en.wikipedia.org/wiki/Browser_exploit http://krebsonsecurity.com/2010/01/a-peek-inside-the-eleonore-browser-exploit-kit/
What current browser exploits exist is anybody's guess however. No spam filter will be able to filter out all malicious URLs though. You will need to educate your users.
All they have to do is view the page. Specifically, it is ran through iframe cross-scripting or Adobe Flash (< v15). There are also more obscure ASP .NET and PHP viruses that utilize drive-by-download tactics. These are less common, but it was how many banks were hacked in 2010.
There have been historically viruses embedded within files. A programmer could script a virus into an audio, image, or video file. The user wouldn't be able to tell because it was a logic bomb and didn't behave unusually. This was rampant during the starting years of P2P and (I assume) still occurs. To this day there are many viruses that have gone undetected because the files appear nonthreatening.
