3

Question

Standard security advice is:

Only download files from websites that you trust.

http://windows.microsoft.com/en-ca/windows/downloading-files-internet-faq

This implies that 1. we are active agents when downloading files from websites and 2. websites cannot download files to our computer without our interaction.

So, let's say I am using Firefox. I go to a sketchy website. Can that website download malicious content to my computer without my interaction or awareness?

Optional Context

I know that web browsers render content on my computer when I surf the web. In one sense then, they are always "downloading" stuff to my computer. Most of that stuff I don't consider to be a download, though. Even streaming videos, while they may cache content, are not downloads in this sense, and I assume these non-downloads do not pose a security threat.

By download, I am talking about what, by default, appears in the Downloads folder of my Windows computer. Usually, I have to click a download link, confirm that I want to save/open the file, and then watch the Firefox download progress. The downloaded file appears in my Downloads folder.

As such, I have given the download permission, I am aware as it is happening, and I can see evidence after it has happened, because it is in my Downloads folder. Further, I have to open the download before it runs. It's an interactive procedure.

Result: I feel safe on a sketchy website, if I do not initiate or accept any downloads. Am I misguided? Can downloads from websites happen without my interaction or awareness?

  1. without my clicking a link on a website
  2. without my giving permission to save/open the file
  3. without the Firefox download progress indicator showing a download, and
  4. without the download appearing in the Downloads folder.
Improve this question
7
  • 2
    From one perspective, the whole point of a web browser is to download files to your local computer, and you don't approve each file as it comes. Can you qualify your question?
    – schroeder ♦
    Commented May 30, 2014 at 15:56
  • @schroeder Done. I have updated my question. I am referring to what usually appears in the Downloads folder on my Windows computer.
    – Shaun Luttin
    Commented May 30, 2014 at 16:24
  • 2
    By using and exploiting flaws in your web browser through embedded Javascript programs... Yes.
    – perror
    Commented May 30, 2014 at 16:35
  • 2
    It usually go through heap-overflow exploitation. For example, you may refer to: Heap Feng Shui in JavaScript by Alexander Sotirov.
    – perror
    Commented May 30, 2014 at 16:48
  • 1
    @ShaunLuttin: Yes, these are commonly used in the kind of scenario you were describing. Sorry to not have written a full answer, but I can't spend too much time on it now. :-/
    – perror
    Commented May 30, 2014 at 16:52

1 Answer 1

Reset to default
2

Latest version of Firefox? Not that I'm aware of, though in the past there has been at least one remote execution vulnerability that could be used for surreptitious downloading (though I'm not aware of it being used for that; rather, it was used to unmask TOR users).

Historically, the "download without your knowledge or consent" browser was Internet Explorer: ActiveX controls were originally intended to be downloaded automatically, and even once Microsoft realized this was a bad idea, there have been various exploits that would let attackers bypass protection.

Improve this answer
2
  • Does that mean the latest version of Firefox is immune to drive-by-downloads?
    – Shaun Luttin
    Commented Jun 1, 2014 at 15:23
  • 1
    @ShaunLuttin, it means there are no known ways of making Firefox perform a drive-by download.
    – Mark
    Commented Jun 1, 2014 at 19:11

Not the answer you're looking for? Browse other questions tagged .