Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 937391" data-attributes="member: 32260"><p>The nasty thing related to drive-by downloads is that a user can download &amp; execute only safe files and still the malicious code can be executed without user (direct) interaction. For example, this can be done when the hacked/malicious website will drop a malicious DLL into the User Downloads folder and the user will download and execute a legal file (usually digitally signed) vulnerable to DLL hijacking. This method can be still detected by standard AV modules (signatures, heuristics, behavior-based) but it will bypass most anti-exe solutions and many protections based on EXE reputation/sandbox Cloud lookup (Windows Smartscreen Application Reputation, Avast/AVG Hardened Mode and CyberCapture, etc.). Also using Virus Total and online Sandboxes to check the downloaded EXE file will not help. Some reputation-based solutions (like Norton Download Insight) can stop such attacks. Also, some other AVs can be configured to do so (Kaspersky, Comodo, etc.).</p></blockquote><p></p>

[QUOTE="Andy Ful, post: 937391, member: 32260"] The nasty thing related to drive-by downloads is that a user can download & execute only safe files and still the malicious code can be executed without user (direct) interaction. For example, this can be done when the hacked/malicious website will drop a malicious DLL into the User Downloads folder and the user will download and execute a legal file (usually digitally signed) vulnerable to DLL hijacking. This method can be still detected by standard AV modules (signatures, heuristics, behavior-based) but it will bypass most anti-exe solutions and many protections based on EXE reputation/sandbox Cloud lookup (Windows Smartscreen Application Reputation, Avast/AVG Hardened Mode and CyberCapture, etc.). Also using Virus Total and online Sandboxes to check the downloaded EXE file will not help. Some reputation-based solutions (like Norton Download Insight) can stop such attacks. Also, some other AVs can be configured to do so (Kaspersky, Comodo, etc.). [/QUOTE]

Verification