A new feature is coming to Google Chrome that will automatically block drive-by-downloads, improving user.
First, it should be noted that drive-by downloads originated from website iFrames and occur when a user downloads a file without having requested it themselves. This is a sneaky technique that has been adopted by attackers who want to drive malware payloads to target machines without requesting any input from users. Drive-by downloads are used for malvertising, as attackers hide malicious scripts in websites’ iFrames, which are downloaded when a user loads the website. However, this includes “user interaction” situations where people mistakenly click on misleading ads or fake system error messages that appear on websites, which then trigger automatic downloads.
A Google spokesperson said that content providers should be able to stop drive-by downloads for content in iframes. Additionally, the Google Chrome team plans to prevent downloads in sandboxed iframes that do not show user interaction, and there will be a restriction with the keyword “allow-downloads-without-user-activation” if a user does.
As discussed in the team, this new feature will be added, which will prevent downloads caused by "navigations and simulated clicks on links", which will not require any intervention from the user. More specifically, Google Chrome will block drive-by downloads that meet the following conditions:
- When the download is triggered by or from navigations. These are the only types of downloads that could occur without any user action.
- When the click or navigation occurs in a sandboxed iframe, if the indications do not contain the keyword "allow-downloads-without-user-activation".
- When the frame does not have a transient movement at the moment of click or navigation.
Surely, once this feature is added, users will be protected from maldvertising campaigns that work through advertisements to spread malicious downloads.
