The download URL is essentially a redirect to protect file paths. This is default in K2.
Now, if uploads don't work (since you don't see the actual file), perhaps it's a file permissions issue on your server.
Since K2 v2.10.4 (the next update) improved the upload logic for attachments, please try out the dev release and see if that works (in case it's related to MIME detection or other issues resolved in v2.10.4):
getk2.org/downloads/?f=K2_Development_Release.zip