This is a follow-up question related to Is single-click phishing possible?.

If such a convenient attack is possible, I assume everyone on the internet should already be hacked. Why hasn't that happened?

  • Fixes by nature come later than the attacks, don't they? And how many people update software timely? – an0 Oct 5 '18 at 15:36
  • Who said it was so easy? The users answering the question you're pointing to aren't saying that it's easy at all, they're just telling you what CAN happen. They do not tell you about how difficult it is to make these things happen. There are so many security measures out there people can put in place to prevent many of the types of attacks listed by the answers in your other question that can make it ridiculously difficult to find a way to make such attacks work. The attacks are likely not as convenient as you're thinking they are. – xorist Oct 5 '18 at 17:34
  • By "convenience" I don't mean it is easy to do. I mean it doesn't require additional tricks to further phish users after they click the URL. – an0 Oct 5 '18 at 18:27
  • Those attacks do require further tricks. That's what I'm saying. Before you can preform something like a drive-by attack you're going to have to spend an incredible amount of time trying to find a flaw in the browser you're exploiting.. Most people don't even know where to start looking for such a thing. It's not as rudimentary as just whippin' up an exploit script. not to mention, it's not an invisible thing. exploits get found and quickly patched by the software developers. – xorist Oct 5 '18 at 18:29

You don't describe the attacks you envision in detail but regarding classical drive-by-downloads:

  • Browsers like Chrome and Firefox get automatically updated since a long time, i.e. they don't rely on the user to update the browser anymore. Also, browsers got better sandboxes in the last years so that the impact of an attack got less severe.
  • Same is with OS like Windows which also more and more enforce updates.
  • To attack lots of users the attacker needs to make users visit a site spreading these attacks. Modern browsers have builtin blacklists so that once such attack gets found the site spreading the attack and maybe similar sites gets blacklisted and the user cannot visit these sites anymore and thus cannot get attacked.
  • Major attack vectors like Flash and Java got closed, either by disabling the relevant plugins forever or at least for most sites.

In other words: there are less vulnerabilities now, they are harder to exploit than in the past and it is harder for an attacker to infect lots of users without being detected and quickly blacklisted. These things together make drive-by-download attacks much harder to do and much more costly for an attacker. The attackers therefore move to different ways to attack users: while attacks via web went down in the last years attacks via mail actually increased.

Also, even in the past where drive-by-downloads using Flash, Java or ActiveX where kind of easy, the sites spreading drive-by-downloads where quickly blacklisted by the browsers and by antivirus products or the sites were taken down. Thus these attacks were never as omnipresent as necessary to hack almost everybody.

  • Thanks for your answer. These are my takeaways from users perspective: 1. Update software timely, especially system and browsers. 2. No need to live in fear. We shouldn't be required to carefully inspect every URL before clicking(Is that even possible now that short URLs are so popular? I'm only taking about one-click attack not how one can be tricked after he lands on the website.). Am I getting it right? – an0 Oct 5 '18 at 18:23
  • @an0: "We shouldn't be required to carefully inspect every URL before clicking" - this would probably not help much anyway. Most attacks are not obvious just from looking at the URL. Apart from that: worry, but maybe don't be too paranoid. Stay up to date and limit your attack surface by not installing arbitrary or outdated software on your system, an ad blocker might limit the attack surface further. Be also careful when reading mails since this is the major attack vector today and attackers like to impersonate Amazon, Paypal, DHL, various banks etc in mails. Make backups. – Steffen Ullrich Oct 5 '18 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.