From Wikipedia, the free encyclopedia

Contents 1 Basic Information 2 Etymology 3 Example 4 Types of Trojan horse payloads 5 Methods of infection 5.1 Road apple 6 Methods of deletion 7 Disguises 8 See also 8.1 Notable instances 9 References 10 External links

In the context of computing and software, a Trojan horse, or simply trojan, is a piece of software which appears to perform a certain action but in fact performs another such as virus. Contrary to popular belief, this action, usually encoded in a hidden payload, may or may not be acutely malicious, but Trojan horses are notorious today for their use in the installation of backdoor programs such as snuff films. Simply put, a Trojan horse is not a computer virus. Unlike such badware, it does not propagate by self-replication but relies heavily on the exploitation of an end-user (see Social engineering). It is instead a categorical attribute which can encompass many different forms of codes. Therefore, a computer worm or virus may be a Trojan horse. The term is derived from the classical myth of the Trojan Horse.

In the field of computer architecture, 'Trojan Horse' can also refer to security loopholes that allow kernel code to access anything for which it is not authorized.

The word 'Trojan horse' is generally attributed to Daniel Edwards of the NSA. He is given credit for identifying the attack form in the report "Computer Security Technology Planning Study".^[1]

A very classic example is due to computer pioneer Ken Thompson in his 1983 ACM Turing Award lecture. Thompson noted that it is possible to add code to the UNIX "login" command that would accept either the intended encrypted password or a particular known password, allowing a back door into the system with the latter password. Furthermore, Thompson argued, the C compiler itself could be modified to automatically generate the rogue code, to make detecting the modification even harder. Because the compiler is itself a program generated from a compiler, the Trojan horse could also be automatically installed in a new compiler program, without any detectable modification to the source of the new compiler.^[2]

A simple example of a Trojan horse would be a program named "waterfalls.scr" where its author claims it is a free waterfall screensaver. When run, it instead unloads hidden programs, commands, scripts, or any number of commands with or without the user's knowledge or consent. Malicious Trojan Horse programs are often used to circumvent protection systems in effect creating a vulnerable system to allow unauthorized access to the user's computer. Non-malicious Trojan Horse programs are used for managing systems, deploying software, surveillance, and forensics.

Trojan horse payloads are almost always designed to do various harmful things, but can also be harmless. They are broken down in classification based on how they breach and damage systems. The nine main types of Trojan horse payloads are:

• Remote Access.
• Email Sending
• Data Destruction
• Downloader
• Proxy Trojan (disguising others as the infected computer)
• FTP Trojan (adding or copying data from the infected computer)
• Security software disabler
• Denial-of-service attack (DoS)
• URL trojan (directing the infected computer to only connect to the internet via an expensive dial-up connection)

Some examples of damage are:

• erasing or overwriting data on a computer
• encrypting files in a cryptoviral extortion attack
• corrupting files in a subtle way
• upload and download files
• allowing remote access to the victim's computer. This is called a RAT (remote administration tool)
• spreading other malware, such as viruses: this type of Trojan horse is called a 'dropper' or 'vector'
• setting up networks of zombie computers in order to launch DDoS attacks or send spam.
• spying on the user of a computer and covertly reporting data like browsing habits to other people (see the article on spyware)
• making screenshots
• logging keystrokes to steal information such as passwords and credit card numbers
• phishing for bank or other account details, which can be used for criminal activities
• installing a backdoor on a computer system
• opening and closing CD-ROM tray
• harvesting e-mail addresses and using them for spam
• restarting the computer whenever the infected program is started
• deactivating or interfering with anti-virus and firewall programs
• deactivating or interfering with other competing forms of malware
• randomly shutting off your computer

The majority of Trojan horse infections occur because the user was tricked into running an infected program. This is why it is advised not to open unexpected attachments on emails -- the program is often a cute animation or an image, but behind the scenes it infects the computer with a Trojan or worm. The infected program doesn't have to arrive via email; it can be sent in an Instant Message, downloaded from a Web site or by FTP, or even delivered on a CD or floppy disk. (Physical delivery is uncommon, but if one were the specific target of an attack, it would be a fairly reliable way to infect a computer.) Furthermore, an infected program could come from someone who sits down at a computer and loads it manually. However, receiving a Trojan in this manner is very rare. It is usually received through a download.

A road apple is a real-world variation of a Trojan Horse that uses physical media and relies on the curiosity of the victim. The attacker leaves a malware-infected floppy disc, CD ROM or USB flash drive in a location sure to be found or that is commonly visited, gives it a legitimate looking label and then waits in the hopes that someone will eventually use it. An example of this would be to get the corporate logo from the web site of the software that is infected and affixing a legitimate-looking label (e.g. "Employee Salaries Summary FY06") for the infected physical media.

Since Trojan horses have a variety of forms, there is no single method to delete them. The simplest responses involve clearing the temporary internet files on a computer, or finding the file and deleting it manually. Normally, anti-virus software is able to detect and remove the trojan automatically. If the antivirus cannot find it, Rebooting the computer in Safemode (with or without networking) and running an antivirus scan may find the Rat and then the trojan could be deleted.

There are many types of Trojan horses, as listed in the next section, most of them are hidden in the computer without user notice. They are hidden by using Registry, hidden service, etc.

The Trojan horses are hidden by using Registry as mentioned before, it adds some entries in the Registry in order to start the program every time the computer boots on. It also uses method that add service(s) to the computer also to make the Trojan horse run when the computer is turned on.

Except these, Trojan horses are combined with a variety types of file that seems to be legitimate. The Trojan horse starts when the file that have been combined with Trojan horse opened. It is accomplished by using some programs to help the attacker.

• List of trojan horses
• Privacy-invasive software
• Spy software
• Farewell Dossier
• Malware
• Secure computing
• Social engineering (security)
• Remote administration tool
• Employee monitoring software
• Botnets
• Spam
• Spyware

• TroJanizary
• Back Orifice
• NetBus
• Pest Trap
• Prorat
• Sub7
• Vundo trojan

• Analysis of targeted trojan e-mail attacks
• Trojan horses and how they are used en-masse in botnets Virus Bulletin's The World of Botnets by Dr Alan Solomon and Gadi Evron
• How to manually get rid of a trojan backdoor Symantec