All your iFRAMEs point to Us

TLDR

The web’s expanding role as a primary information platform also makes it a major vector for infection, with drive‑by downloads exploiting URLs to automatically install malware. This study investigates the prevalence of drive‑by downloads on the Internet and explores various aspects of the problem. The authors processed billions of URLs over ten months, identifying over 3 million malicious URLs that trigger drive‑by downloads, and examined how browsing habits, luring techniques, and network properties influence exposure. The analysis revealed over 3 million malicious URLs that trigger drive‑by downloads, and about 1.3% of Google search queries returned at least one such malicious URL.

Abstract

As the web continues to play an ever increasing role in information exchange, so too is it becoming the prevailing platform for infecting vulnerable hosts. In this paper, we provide a detailed study of the pervasiveness of so-called drive-by downloads on the Internet. Drive-by downloads are caused by URLs that attempt to exploit their visitors and cause malware to be installed and run automatically. Over a period of 10 months we processed billions of URLs, and our results shows that a non-trivial amount, of over 3 million malicious URLs, initiate drive-by downloads. An even more troubling finding is that approximately 1.3% of the incoming search queries to Google's search engine returned at least one URL labeled as malicious in the results page. We also explore several aspects of the drive-by downloads problem. Specifically, we study the relationship between the user browsing habits and exposure to malware, the techniques used to lure the user into the malware distribution networks, and the different properties of these networks.