A drive-by download refers to the unintentional download of malicious code to your computer or mobile device that leaves you open to a cyberattack. You don't have to click on anything, press download, or open a malicious email attachment to become infected. A drive-by download can take advantage of an app, operating system, or web browser that contains security flaws due to unsuccessful updates or lack of updates. Unlike many other types of cyberattack, a drive-by doesn't rely on the user to do anything to actively enable the attack.
How It Works
Drive-by-download malware often uses small pieces of code designed to slip past simple defenses and go largely unnoticed. The code doesn't need to be highly complex because it mainly has one job: to contact another computer to introduce the rest of the code it needs to access a mobile device or computer.
Often the malicious code is distributed by compromised websites. Hackers often use something called an exploit kit. These kits contain software designed to run on web servers and identify software vulnerabilities on machines and web browsers to determine which systems are ripe for the plucking. The software may seem innocuous, but it's contained on sites corrupted by malware. In fact, one of the greatest dangers is the ease of attracting visitors to sites that seem innocent.
For example, you might get a link emailed to you or a post on your social media feed — sources you trust — that are designed to entice you to click and open. Once the website is open, the drive-by download installs itself on your computer or mobile device.
How to Avoid Attacks
As with many aspects of cyber safety, the best defense is caution. Never take your security for granted, and always avoid websites that may contain malicious code. Stick to the mainstream sites you normally use or at least well-established sites — although keep in mind that even these sites can be hacked.
Keeping your web browser and operating system up to date is also crucial. New patches help seal gaps in their defenses where drive-by-download code could burrow in.
You should also use a security solution such as Kaspersky Lab’s one on all your devices to ensure your defenses are always up to date and ready to protect you against ever evolving new threats. It's also a good idea to use an ad-blocker, as drive-by download attacks often use online ads to upload infections. Using an ad blocker can help reduce your exposure to this type of attack.
Additionally, be wary of keeping too many unnecessary programs and apps on your device. The more plug-ins you have, the more susceptible you are to infection. Only keep the software you trust and use often.