The Drive-By Download Attack
When you click a legitimate download link on a website, Google Chrome saves the file to your computer. However, some malicious websites employ a technique called “drive-by downloading” or “download bombing.” The moment you click a single link, the website rapidly attempts to push five or six executable files to your hard drive simultaneously. Chrome usually tries to catch this behavior by prompting you, but if you have previously granted a site permission (or if a trusted site gets hacked), you could find your downloads folder flooded with malware in a matter of seconds. To maximize your security, you must force Chrome to aggressively block all automatic, multi-file downloads.
How to Block Automatic Downloads Globally
You can permanently sever a website’s ability to trigger multiple simultaneous downloads via the Site Settings.
- Open the Google Chrome desktop browser.
- Click the three vertical dots (â‹®) in the top right corner and select Settings.
- In the left-hand sidebar, click on Privacy and security.
- In the main window, click on Site settings.
- Scroll down to the bottom and click to expand Additional permissions.
- Click on Automatic downloads.
- Under the “Default behavior” heading, select the radio button for “Don’t allow sites to automatically download multiple files.”
Strict Enforecement
The change takes effect instantly. Google Chrome will completely lock down the download pipeline. A website will only be allowed to push a single file to your hard drive when you explicitly click a link. If a malicious script attempts to immediately trigger a second, third, or fourth download behind the scenes, Chrome will violently reject the connection, ensuring your hard drive is protected from rapid-fire malware injections.