Trojan Horse

A Trojan horse is a program that appears to be performing one task while executing a malicious task in the background. It may reach your computer as an email attachment, usually as amusing or seemingly useful software to entice you to open it. Once you open the attachment, the Trojan horse program can search for your user information, steal your login names, and copy your passwords. Some Trojan horse programs can delete, modify, or transmit files on your computer. And, some Trojan horse programs may contain viruses, worms, or other Trojan horse programs. Trojan horse programs can use your account privileges to install other programs such as programs that provide unauthorized network access. Or, they can use your account to attack other systems and implicate your site as the source of an attack.

In addition, these Trojan horse programs can further exploit vulnerabilities in your system to increase the level of access beyond that of the user running the Trojan horse, such as administrative access. Once the intruder obtains administrative access, the intruder can do anything that an administrator can such as changing login and password information on other computers, and installing software applications. When an intruder gains administrative access to your systems, it is very difficult to trust the machine again without reinstalling the system software.

Despite the destructive power of Trojan horse programs, these programs cannot execute unless they are run on the target system. An intruder may trick the user to run the program. By understanding the various methods the intruder may use to manipulate users to execute Trojan horse programs on their systems, you can better identify a Trojan horse attack tactic and avoid being a victim.

An intruder can entice a user to run a Trojan horse program by forging an email as a Microsoft representative instructing the user to open an attachment to perform procedures that would patch a security weakness. The user would then open the attachment, which is actually a Trojan horse program. An intruder may also use social engineering ploys such as calling a system administrator and posing as a legitimate system user who cannot launch a specific software application. The intruder would then manipulate the system administrator to open a Trojan horse program.

Intruders can use compromised software download sites and replace legitimate versions of software with Trojan horse versions. An intruder can trick the users by redirecting them to a website to download a Trojan horse program. In addition, a Trojan horse program may be placed on a website in the form of Java, JavaScript, or ActiveX component. Note that Java, JavaScript, and ActiveX are also known as mobile codes. These programs are executed by your Web browser once you access the site. To avoid Trojan horse attacks via malicious websites, you can disable Java, JavaScript, and ActiveX in your Web browser. However, disabling these features may hamper your viewing of certain websites. A good practice is to disable Java, Java Script, and ActiveX and only enable them when necessary.

You can learn more about ActiveX security from the CERT website.

More information regarding the risks posed by malicious code in web links can be found on the CERT website.

Worm

A worm is malicious software that can execute itself on a vulnerable remote machine. Compared to a viruses, which infect files and spread through the transfer of infected files and email messages, worms can penetrate computer systems more easily because they do not need a user to execute them. Worms can perform trigger events that vary from display of irritating messages to destruction of data.

Most worms travel within email messages and TCP/IP packets, replicating from one computer to another. A worm can arrive as a mass-mailing worm that sends itself to every address in the email address book of an infected computer. To cover its tracks, a mass-mailing worm can set the "From:" line of the message to be a randomly selected address from the email address book.

Worm sample: 911 Worm

This worm is also known as Chode, Worm.Firkin, and other names. It searches through a range of IP addresses of known ISPs to find an accessible computer that has a non-password-protected shared drive. It uses the shared drive to copy its files onto the other computers. Once the infected computer starts Windows, a .vbs script is launched. On the 19th of the month, this script deletes files from the following directories:

C:\windows  C:\windows\system  C:\windows\command  C:\  Then, it displays a message indicating the machine has been infected.

You can learn more about the 911 Worm from Symantec's website.