6

I am aware of the problem of drive-by downloads, which happens when one visits a malicious site and a malware is downloaded to the PC. I want to ask that when such a program is downloaded, how does it manage to execute?

Improve this question

1 Answer 1

Reset to default
6

Drive by downloads exploit vulnerability (or a set of vulnerabilities) either in the core browser engine or one of its extension to gain code execution. The index page the user initially visits contain the first stage of the exploit which might contain JavaScript for exploiting a use-after-free bug in the browser or might contain Java or ActionScript to exploit the one of the extensions loaded by the browser. The first stage then download more malware to achieve complete compromise.

Improve this answer
2
  • 1
    So the first stage downloads more malware (exe's I presume on Windows, or a binary on linux) and starts executing them for complete compromise ?
    – Jake
    Commented Mar 23, 2014 at 14:04
  • 2
    That is right. Malware is split into multiple stages to save space as well as well bypass security controls such as AV, HIDS etc.
    – void_in
    Commented Mar 23, 2014 at 15:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .