Are there cases where a serious drive-by download attack could crash the operating system or the browser ?


Most drive by attacks work by using exploits. Exploits are often bugs in code, so if they try to exploit one and it doesn't work, then crashing your software or possibly your computer are a good possibility even if the attack itself doesn't get them the result they were hoping for.

If the attack actually works and they get access to your computer, then they can potentially do anything they want, depending on the access level they are able to achieve, up to and including deleting all your files and possibly even breaking the hardware itself if they are particularly clever (such as causing overheating to break stuff).

| improve this answer | |

Yes. This is part of the more general first immutable law:

If a bad guy can persuade you to run his program on your computer, it’s not your computer any more.

| improve this answer | |
  • I think in drive-by download attacks it is possible to install malware when visiting an evil website without the user's permission (at least, it is what i understand on the Wikipedia link) – user47731 Jun 4 '14 at 12:34
  • That "law" is only true if you system's security model is really simplistic: no sandboxing, user has full control, etc. It's an important first step in a compromised but it's not automatically sufficient – Stephane Jun 4 '14 at 12:59
  • I agree @Graham Hill. An infection aims to gain control over a machine, when an infection successfully occurred, the attacker has control over your machine and therefore can do anything (e.g crash your OS). This might also occur during the infection as using an exploit might yield in undefined behaviour of a system. – Samuel Jun 4 '14 at 13:49
  • @Stephane I wish that were the case, but escape from sandboxes and privilege escalations are common enough that Microsoft's first immutable law still stands. – Graham Hill Jun 4 '14 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy