The expression drive-by download is used in four increasingly strict meanings:
- Downloads which the user indirectly authorized but without understanding the consequences (eg. by installing an unknown ActiveX component or Java applet).
- Any download that happens without knowledge of the user.
- Download of spyware, a computer virus or any kind of malware that happens without knowledge of the user. Drive-by downloads may happen by visiting a website, viewing an e-mail message or by clicking on a deceptive popup window: the user clicks on the window in the mistaken belief that, for instance, it is an error report from his own PC or that it is an innocuous advertisement popup; in such cases, the "supplier" may claim that the user "consented" to the download though s/he was completely unaware of having initiated a malicious software download.
- Download of malware through exploitation of a web browser, e-mail client or operating system bug, without any user intervention whatsoever. Websites that exploit the Windows Metafile vulnerability may provide examples of "drive-by downloads" of this sort.
The expression drive-by install (or installation) is completely analogous and refers to installation rather than download (though sometimes the two are used interchangeably).
In April 2007 researchers at Google discovered hundreds of thousands of web pages performing drive-by downloads.[1][2]
See also
References
- ^ Niels Provos; Dean McNamee; Panayiotis Mavrommatis; Ke Wang; Nagendra Modadugu (2007-04-10). "The ghost in the browser: analysis of web-based malware". HotBots'07. Cambridge, MA: USENIX. http://www.usenix.org/events/hotbots07/tech/full_papers/provos/provos.pdf. Retrieved 2007-05-11.
- ^ "Google searches web's dark side". BBC News. 2007-05-11. http://news.bbc.co.uk/2/hi/technology/6645895.stm.
 |
This malware-related article is a stub. You can help Wikipedia by expanding it. |
This entry is from Wikipedia, the leading user-contributed encyclopedia. It may not have been reviewed by professional editors (see full disclaimer)
