Generally on web pages, you have to click a link or a button or do something to enable the page to download malware to your device.
But, if your software is sufficiently out of date or missing security updates, then it may be possible for a web page to initiate a download of malware without you taking any action and it may not warn you of the download.
This can be very dangerous.
Anti-malware services can generally spot such danger and block the download but the key is to always keep your software fully up to date.
Common drive-by exploits
Hackers looking to create drive-by malware, generally look at the following:-
- Old operating systems
- Browsers such as FireFox, Chrome, Opera, and others, especially out of date versions
- Out of date browser plug-ins
- Early versions of Microsoft Office
- Adobe/Shockwave Flash (ActiveX)
- Adobe Reader
- WinZip compression
The types of drive-by malware commonly found include:-
- Trojan horses – these take remote control of the user’s device
- Ransomware—allows the attacker to encrypt or threaten to destroy data on the device unless a ransom is paid
- Botnet toolkits—attackers may install a botnet application that on many devices which can then be controlled as one to carry out actions such as sending spam email or participating in DDoS attacks
- Man in the Middle tools—enables attackers to eavesdrop on the user’s communications
- Keyloggers—capture keystrokes and feed them back to the hacker.
If you have any experiences with scammers, spammers or time-wasters do let me know, by email.
