5

I am aware of the problem of drive-by downloads, which happens when one visits a malicious site and a malware is downloaded to the PC. I want to ask that when such a program is downloaded, how does it manage to execute?

5

Drive by downloads exploit vulnerability (or a set of vulnerabilities) either in the core browser engine or one of its extension to gain code execution. The index page the user initially visits contain the first stage of the exploit which might contain JavaScript for exploiting a use-after-free bug in the browser or might contain Java or ActionScript to exploit the one of the extensions loaded by the browser. The first stage then download more malware to achieve complete compromise.

  • So the first stage downloads more malware (exe's I presume on Windows, or a binary on linux) and starts executing them for complete compromise ? – Jake Mar 23 '14 at 14:04
  • 1
    That is right. Malware is split into multiple stages to save space as well as well bypass security controls such as AV, HIDS etc. – void_in Mar 23 '14 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.