Trojans Daniel Bartsch CPSC 420 April 19,2007
What is a Trojan? Trojans are malware Named after Odysseus’s mythical trick Embedded in a program Cause a variety of undesired effects Not simple to define! ©2007 Steve Smith and World of Stock
Why are Trojans Hard to Define? Definition creep! Should only refer only to infected file Term expanded to refer to effects file has as well Trickery used to prevent program removal commonly classified as trojan
A Trojan is Not A Virus Confusion caused by virus scanners Viruses infect other files The goals are different Viruses do not rely on tricking the user Viruses do require action from the user
A Trojan is Not a Worm Worms do not require action from the user Worms exploit security flaws Worms spread themselves Worms typically make multiple copies of themselves
What are Some Properties of Trojans? Use trickery in some form Do not typically spread themselves File they are attached to has to be put into use at least once Have means to continue running Can be added to virtually anything
What Kinds of Trickery do Trojans Use? Highly desirable files Exclusive Rare Free Codec Packs Bootlegs New files No CD cracks Key Generators
What Kinds of Trickery do Trojans Use? Disguises Fake error messages Lies from the sender Rootkits Encryption Vague process names
What Kinds of Things are Trojans Used for? Pranks Make some zombies Denial of service attacks Proxies Servers Spam Mess with data
What Kinds of Things are Trojans Used for? Disabling security software - the blended threat Spying Key logging Drive Access Spyware and Adware Backdoors
What Kinds of Things are Trojans Used for? Remote Administration
What are Some Common Trojans? BO2K NetBus SubSeven SpySheriff
BO2K Free program marketed as a RAT Reputation caused classification Windows 2000, NT, XP Actively Developed Continuation of Back Orifice
Some Features of BO2K Key logging Registry Editing Remote upgrade and installation Connection redirection Audio and video capture Remote Reboot
BO2K in Action
NetBus Intended for pranks Famously used to put child pornography on Magnus Ericson’s computer
SubSeven Allows attacker to lock out other attackers Early versions included a master password
Optix Pro Fully customizable Can disable security No longer in development
Optix Pro Configuration
SpySheriff Not a Remote Administration Trojan Masquerades as a spyware scanner Blocks connections, Disables internet connections, prevents system restores Can reinstall itself and give itself administrative rights
SpySheriff
One Famous Use of a Trojan US learned of a Soviet plot to steal turbine control software Leaked software with a trojan Software used in Trans-Siberian gas pipeline Caused one of the largest non-nuclear explosions and fires ever
Dealing with Trojans Research required to remove any Trojan that a virus scanner can’t remove by itself Preventative measures are best Multiple firewalls Disconnect computers from networks if use of a RAT is suspected
Sources – authentication required
Any Questions? Trojan Rabbit from Monty Python and the Holy Grail