Drive-by downloads represent a shift in the methods used by hackers to invade your systems. Not long ago, wide-scale attacks that took aim at overwhelming computing resources were the preferred game plan. Such attacks use a “push” model. As network tools got better at defending against denial-of-service attacks, the bad guys adopted a “pull” model that has users inadvertently downloading unwanted payloads.
Two “pull” techniques are in wide use today. In one, hackers use social engineering to entice trusting users to perform some action that downloads software carrying a payload. For example, clicking on a link to an e-card that turns out to be bogus. Fortunately, end users can be taught to be cautious of such con games. [my edit (err, we try to teach them) ]
The second, more ominous method is to automatically deliver the payload when the user lands on a compromised Web page. Worst of all is that landing on a malicious site is often completely out of the hands of the Web surfer, as he may actually be taken there without his knowledge.