What exactly is a java drive-by?

And how would it be dangerous?
i mean it's not like you're playing rs, hit a link, and it takes your password.
or does it?

 

Actually it does do that. Goto a link.. Ask you to run java because something requires java and boom your infected. But much more than stealing your password. More like screwing your computer and possibly taking it over whenever the people who made the driveby want.

 

"Drive-by download means three things, each concerning the unintended download of computer software from the Internet:

1. Downloads which a person authorized but without understanding the consequences (e.g. downloads which install an unknown or counterfeit executable program, ActiveX component, or Java applet). This is usually caused by the pure security design[clarification needed]. The user should not be frequently asked to accept security-critical decisions, often with very limited knowledge and within limited time.

2. Any download that happens without a person's knowledge.

3. Download of spyware, a computer virus or any kind of malware that happens without a person's knowledge.

Drive-by downloads may happen when visiting a website, viewing an e-mail message or by clicking on a deceptive pop-up window:[1] by clicking on the window in the mistaken belief that, for instance, an error report from the computer itself is being acknowledged, or that an innocuous advertisement pop-up is being dismissed. In such cases, the "supplier" may claim that the person "consented" to the download although actually unaware of having started an unwanted or malicious software download. Websites that exploit the Windows Metafile vulnerability (eliminated by a Windows update of 5 January 2006) may provide examples of drive-by downloads of this sort.
A drive-by install (or installation) is a similar event. It refers to installation rather than download (though sometimes the two terms are used interchangeably)."

Thank You Wikipedia.

 

You should have your firewall setup and it will usually say like...


*********
Unknown Publisher wants access.

If you say no, nothing can happen.

 

There is usually a window which pops up and asks if you allow the drive by to run, if its from a trusted sources like rs or something it wouldnt be a problem but if its from a shady site then I would not click yes.

 

Its the pop-up that you get when you first play runescape (though runescapes one is not a java drive-by). Anyways you get the same java application, and it ask if you will give the apllication permission. once you click yes, you are automatically connected to a RAT or Keylogger. Thats why i suggest not using Private servers

 

In short once you allow the java drive by access, it has administrative powers similar to remote access. It's pretty much a super sneaky way of installing a RAT.