1

I have come across many people who don't believe in antivirus solutions and don't patch or update their OS and applications. "I never visit dodgy websites", "I only use the internet to read emails" "I am not stupid, I can distinguish between emails that are dodgy and which are not" ... you know what I mean.

I need to show them that they are vulnerable without causing them damage. Is there a way or a script I can use to show them exactly how naive they are? A script which would do a drive by download which would trigger a "you have been pwned" would do the job.

NamSandStorm
  • 227
  • 1
  • 6
  • I did not answer you to : A website which would do a drive by download which would trigger a "you have been pwned" would do the job. as it is a product recommendation (off-topic here, remove it if you want to prevent future downvotes) and such websites are blaklisted by search engines and web scanners after few days of activity. –  Oct 11 '15 at 15:17
  • Thank you Begueradj. The problem is that people always seem to know better, i.e. "This will never happen to me". Forcing it to happen to them, without causing damage may wake them up. That is the idea. – NamSandStorm Oct 11 '15 at 15:34
  • To be honest, it sort of sounds like you have the kind of user/s on your hands that are so convinced of their own complete grasp of the irrelevance of cybersecurity that they might brush off anything you might be able to do. Still....Well, before trying to set up a live demo of a drive-by attack I might try talking to them about, say, malvertisements. Or maybe watering-hole attacks. Both of which can & do happen on extremely popular, completely "respectable" sites. A good primer: http://www.cnbc.com/2014/05/20/beware-of-malicious-ads-that-can-harm-computers-without-a-click.html – mostlyinformed Oct 12 '15 at 07:45

1 Answers1

3

Is there a way or a website to show them exactly how naive they are?

Sure. Start by explaining them the vector attacks of this type of attacks. Tell them that it is common to find vulnerabilities in web browsers, their plugins or even extensions. Explain them that as such vulnerabilities are common, drive-by download attacks are always possible.

This done, a good and effective method, is to give them real world examples of well known safe and reputed website that have been compromised to perform drive-by download attacks. In this, I can give you two examples:

  1. Thousands of visitors of the Amnesty International's homepage on 2011 have been infected by a drive-by download attack. The webpage in question was running a Java applet suffering from the CVE-2011-3544 vulnerability.
  2. On October 24th, 2013, the admins of the famous php.net website said that their website delivered malware to its visitors using a drive-by download attacK.