1. Trojan Horse Program Presented by : Lori Agrawal

2. Agenda n What is Trojan Horse program? n Who are the targets? n How it gets spread? n Impact of Trojan Horse Attack n Control of hackers over files n Ways to avoid this attack

3. Continue: n Detection of attack n How to remove Trojan from system n Example: SubSeven n Capabilities of SubSeven Program n Parts of SubSeven n A real Trojan Horse Threat n Conclusion

4. What is Trojan Horse Program? n Trojan Horse is one of the today’s most serious threat to computer security. n A malicious security-breaking program disguised as something benign. n A executable program n Once infected, it is controlled totally by a hacker.

5. Who are the most targets? n The home computers n Reasons u Private Content u Availability u Defendless status

6. How it gets spread? n Email attachments n Sending files in chat rooms n Infected computer can attack other computer

7. Impact of Trojan Horse Attack n Complete access to victim’s system n Delete and alter files n Access to Administrator privileges n Other computer get infected n An infected computer can be targeted by any user.

8. Control of hackers over files n Alter user’s private documents such as bank statement, credit card statement, password file, mortgage payments files. n Access files remotely as they own it n Access of chat history

9. Ways to avoid this attack n Don’t download from unknown source n Need to be aware of hidden extension n Don’t use automatically get file feature n Don’t type a command or go to web site told by a stranger n Remove unnecessary services and file shares

10. Detection of attack n Hard to detect whether a computer is infected or not n Not listed under process list of ALT+Ctrl+Delete key n To detect, one can scan his computer for open port

11. How to remove Trojan from system n By getting clean re-installation n Anti-Trojan Software

12. Example: SubSeven n Trojan Horse program that attacks computer running on Window 9.x platform. n More popular than other types as it provides more options.

13. What SubSeven can do? n It can restarts Windows of Victim’s computer. n It can record sound files from microphone used on victim’s machine. n It can record video images from a video camera attached to the victim’s computer. n It can change desktop color, wallpaper and turn on and off the victim’s monitor. n It can open and close CD-ROM drive. n It can capture screen shots of user’s currently activity. n A new version of SubSeven also allow hackers to know whether a victim is presently online, a manager feature that can abort a program running on victim’s machine.

14. Part of SubSeven: n SubSeven Server: Must run on victim’s computer. n Client Program: Used by hacker on his machine to connect to server(Victim’s computer). n Server Editor: An interface to Hacker to choose option how to get information from victim’s computer.

16. A real Trojan Horse Threat n Targets were customer of Paypal’s online service n Spread using sending emails containing subject line “PAYPAL.COM NEW YEAR OFFER” n Emails contained information about payment discount n Create a fake Paypal web site and ask for credit card info.

17. Conclusion n Serious network security problem n Once infected, computer is totally controlled by hacker. n Hard to detect whether a computer is infected or not. n Hard to recover.

18. Any Questions?