Cyberheist Snippet 1: Drive-By Downloads

Understanding drive-by downloads, and the potential risks they pose



A drive-by download is a transfer of software from a Web server to an unsuspecting client that occurs in the background with no notification when a user visits some particular Web page. The “drive-by” terminology indicates that a user need only access the page to be subject to the download, which will invariably include malware when some kind of scam or attack is underway. Because such downloads can install themselves on the systems on which they take up residence, this lets attackers put specific types of malware of their choosing on victim machines. These include programs called keystroke loggers, that record every keypress a user makes on his or her machine into a special file called a keystroke log. These also include a class of software called “Trojans” (short for Trojan Horses, after the famous ruse that let the Greeks gain access to the city of Troy in The Iliad). These programs can access the Internet, and ship that keystroke log off to some designated recipient address. Once received, that keystroke log can be combed for sensitive information — particularly accounts, passwords, challenge-response sequences, and other information that may be used to impersonate authorized users and steal the money at their disposal.

For more information on drive-by downloads, please consult any or all of the following references