1

I was using a movie streaming website, (the ones with all the pop-up ads at each click). Usually I just close the ad and nothing happens but recently when the ad pops up a .exe file is downloaded and luckily Chrome stopped it as it was labelled dangerous. I'm just curious as to how a file is automatically downloaded without my permission and what I can do to prevent it?

2
  • 4
    Step number one is not using websites of questionable legality, as those are more likely to be filled with malicious ads :) Jul 17, 2020 at 14:16
  • 4
    Step number two is using an ad blocker
    – nobody
    Jul 17, 2020 at 14:34

2 Answers 2

8

"Usually I just close the ad"

Well, you think you closed the window. What you did was click on something, which permitted the download.

Most everyone just looks for the little "X" to close the window. The scammers know this and manipulate what looks like a window so that you actually click a download button.

4
  • Very interesting topic of ads as a malware network. If we want to conduct research on malicious ads, how may we do that in a safe manner? Sep 18, 2020 at 13:24
  • Sandboxes are the typical tool to let malware run its course in a safe manner.
    – schroeder
    Sep 18, 2020 at 13:28
  • Thanks, but I was referring to is there some special sandbox software for this case, apart from OS running on a VM? Sep 18, 2020 at 13:31
  • 1
    Yes, please do a search for "malware sandbox"
    – schroeder
    Sep 18, 2020 at 13:34
0

how a file is automatically downloaded

This kind of abuse and is called Drive-by downloads.

Webpages are made full of tags and attributes which isn't limited, but pop-up windows work differently than normal tabs in the sense that these pop-up screens were already triggered by a click when you see a file is downloading in the pop-up screen, this could have been triggered in a normal browser tab.

when the ad pops up a .exe file is downloaded

So it isn't like you need to see a new window first, then click somewhere in that new screen and the download will start. People can program those attributes to instantly download in a new window instead.

2
  • "... So it isn't like you need to see a new window first, then click somewhere in that new screen and the download will start. People can program those attributes to instantly download in a new window instead." That's not true, it would be a violation of basic security protocols. Granted someone may find an exploit, but this is not allowed under HTML restrictions. You have to give permission by clicking on OK, although as Schroeder stated, the OK may be masked as an "X" or something else to trick you into granting permission. Jul 17, 2020 at 15:13
  • @user10216038 Note that I'm saying "pop-up screens were already triggered by a click" OP: when the ad pops up a .exe file is downloaded this is purely because a javascript attribute was triggered by a click (and could indeed be masked) and caused a (blank) window to appear after which a download started in that new screen. You say in HTML, interaction is needed first, which is true. Jul 17, 2020 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.