# Phishing Attacks Survey: Types, Vectors, and Technical Approaches
## 3 Phishing Methods and Techniques
### Phishing Technical Approaches
#### 3.3.8 Drive-by Download  
Drive-by download is a versatile method of malware and shell code delivery, which utilizes avenues such as HTML emails, internet relay chat (IRC), or visited websites. After a victim has been induced to act, malicious code (often written in JavaScript) executes and utilizes browser exploits or plugins to secretly download and install malware on the victim's machine without their consent [55]. When a drive-by download is hosted on a webserver, the attacker has two main options. The first is to redirect the targets to a webserver owned by the attacker. The second, and more effective option, involves the sabotage of legitimate webservers so that they now host these exploits. This method improves the chances of the attack succeeding because the victim's suspicions are not raised if they have good reason to believe a site is legitimate [56]. The most common form of malware installed by a drive-by download is either a trojan, spyware, or botnet. A trojan is malware that is hidden within a legitimate program. Thus, the victim installs or runs a program believing it to be a genuine piece of software, also causing the embedded malware to be executed. Trojans are frequently used to install keyloggers or screen capturing software, which are tools an attacker can use to harvest a victim's personal details. A botnet is a form of malware that allows an attacker to use the victim's device for the attacker's own purposes through remote access. Remote control of the victim's device is conducted using a command and control center. A botnet can also run on a variety of protocols and architectures including HTTP, IRC, P2P (peer to peer), and instant messaging [57]. Turning devices into bots within a botnet allows phishers to use the botnet to perform a variety of tasks [58]:  
* Proxy services
* Distribution and installation of additional malware
* Update current malware
* Scanning for exploits and vulnerabilities
* Surveillance
* Sending spam and phishing emails by acting as relays* Redirect to phishing websites
* Pay-for-click services
* DDOS (Distributed denial of service) attacks  
Symmetec found that the number of botnet URLs increased by 57.6%, from 1.2% of all URLs to 1.5% of all URLs, between 2017 and 2018. Botnets can also be used to instigate fast-flux attacks. Fast-flux is a method of assigning different IPs to the same domain name. This is often used by genuine sites to balance site demand by sharing the load among servers, thus improving performance and reliability. Phishers have devised methods to exploit this system in which botnets are used to hide their sites, thus making it harder for them to be found and shut down, and allowing attacks to persist for longer [57; 59; 60]. The botnet is used as a proxy that hides the all-important Command and Control (C & C) server, thus allowing the attack to be maintained and the bots to be organized. The fast-flux service allows the attack to continue even if some of the bots are taken down, because the domain can be changed to the IP of another bot. The only criterion for maintaining the attack is that bots are recruited faster than they are disabled [61]. A summary of a bot's lifecycle within a botnet is provided in Appendix A. We can compare the lifecycle of a bot (in Appendix A) to the flowchart from [PERSON]'s 2020 paper [62] (a copy of which is provided in Appendix B) regarding when the methods employed by the defender are sufficient. If we take the botnet waiting for a command as the attacker deciding whether to continue or start an attack, then the processes of attacking and defending are remarkably similar. In the flowchart found in [PERSON]'s paper, action is taken until the uncertainty of the actor is below a pre-determined threshold (it is worth noting that this threshold can change over time) at which point the process ends. If we take a botnet based DDOS attack as an example, this threshold may be that an attack has been averted or managed (the load has been successfully shared such that the company is unaffected).