Trojan Horses

Trojans are malicious programs that can cause considerable damage to both the hardware and software of a system. Backdoors are ways to access a device without following the usually required security and authentication procedures.

A legitimate communication path on a network or within a computer system that transfers data is referred to an overt channel . A channel that transfers information and violates the security policy is referred to as a covert channel. To create a covert channel, an overt channel can be manipulated. The Trojan is a simple type of a covert channel.

A Trojan horse, or simply a Trojan, is a malware that is apparently a normal, useable program but actually contains a virus. During the Trojan War, the Greeks used a Trojan horse to obtain access to the city of Troy. Likewise, a Trojan horse enters the victim’s computer undetected and has the same level of privileges as the victim. It can falsely implicate a remote system as an attack source.

A Trojan steals sensitive information, stores illegal materials, and is used as an FTP server for pirated software. A Trojan runs in stealth mode and can alter the registry or other auto-starting methods.

A backdoor is a method used to bypass the usual authentication methods on a system. There are numerous ways that a Trojan can infiltrate a system, including instant message applications, Internet relay cache, attachments, physical access, browser and email software bugs, file sharing, fake programs and freeware, and accessing suspicious sites.

Indicators of a Trojan Attack

If a system experiences any of the symptoms mentioned, it warrants a closer look as to what exactly is going on with that system.

Ports Used by Trojans

Netstat Command

The netstat command can be used to determine which ports are listening. Figure 5-1 shows the results of a netstat command, indicating active connections and identifying which ports are listening.

Types of Trojans

ICMP Tunneling

Arbitrary data is injected into an echo packet sent to a remote device via ICMP tunneling . In the same fashion, the remote machine responds by injecting a response into yet another ICMP packet and returning. Using ICMP echo request packets, the client conducts all communication, while the proxy utilizes echo reply packets. This vulnerability exists because the RFC for governing ICMP packets allows for an arbitrary data length for any echo reply or echo message ICMP packets.

By obfuscating the real traffic, ICMP tunneling could be used to circumvent firewall rules. Obfuscation implies that you conceal the actual meaning of communication. This form of communication can also be classified as an encrypted communication channel between two machines, depending on the configuration of the ICMP tunneling program. Network administrators can’t identify this kind of traffic from their network without sufficient deep packet inspection or log analysis. See Figure 5-2.

Tools Used to Create Trojans

Trojan Countermeasures

Detecting Tools

To detect a Trojan, scan for suspicious open ports. Then scan for suspicious processes that may be running. Scan the registry. Use a tool such as Wireshark to scan for suspicious network activity. Finally, run a Trojan scanner. A few more tools that can be used to detect a Trojan are Netstat, fPort, TCPView, CurrPorts, PrcView, Msconfig, Autoruns, and HijackThis.

Backdoor Countermeasures

The countermeasures listed will help protect a system from having a backdoor created and thereby providing access to an attacker. Care should always be taken when downloading email attachments or installing applications downloaded from the Internet. If the site provides a hash value for a file download, make sure that you verify the value after downloading the file to insure that the file has not been tampered with. You should use an antivirus package that can recognize a Trojan signature and keep your applications updated with the latest security patches.

Countermeasure Tools

Process Monitor

A Trojan can be hidden in any number of .exe files within the Microsoft operating system. A tool such as Process Monitor can be used to monitor system process files. It is a free download from the Microsoft site. It shows real-time file system, registry, and process or thread activity. See Figure 5-3.

Malware Tool: Poison Ivy

User-friendly malware applications such as the Poison Ivy Remote Access Trojan are often used by cybercriminals to enable them to conduct a lot of post-exploitation activities, such as loading malware, executing programs, deactivating services, disrupting processes, and stealing information.

Poison Ivy is a highly dangerous malware tool because it allows hackers to establish a continuous connection to a victim’s machine via an encrypted connection. Poison Ivy has been used as an attack tool in many high-profile incidents, including an attack on the RSA network in 2011.

In the lab, you can set up the Poison Ivy Client, entice the victim to launch the malicious file, and exploit the victim machine with Poison Ivy. See Figure 5-4.

Viruses and Worms

Symptoms of a Virus

Recognizing the symptoms of a virus means you can act faster to limit the damage to your system or your network.

Stages of a Virus’ Life

Anyone with basic programming knowledge can create a virus, and there are numerous tools available for designing a virus. Replication occurs over a period of time. With a virus, human action is required to launch the virus. A virus is identified as a threat after a user notices one of the symptoms previously mentioned. Antivirus software companies incorporate a fix into their products so that users can install the updates and eliminate the virus. Figure 5-5 shows the stages of a virus throughout its life.

Infection Phase

A virus has two phases, really. The first is the infection phase and it is followed by the attack phase. Once a virus is triggered, the sequence of events will continue until the user notices the symptoms and takes the proper steps.

Once a virus has been triggered, it can corrupt the files and programs of its host or perform tasks that are unrelated to the applications running. See Figure 5-6.

Types of Viruses

What Viruses Attack

Another way that viruses can be classified is based on what they infect. A common target is the boot sector, which is an area on the disk that is executed when a computer is started up.

Program viruses infect executable program files or files with .exe, .com, or .sys, for example. Multipartite viruses infect program files which in turn affect the boot sector. Network viruses use the commands and protocols of a computer network to replicate.

Source code viruses are more unusual due to the skill required to write them, and there are many types of source code out there. Macro viruses perform a sequence of actions when an application is run.

How Viruses Infect

Viruses can also be classified according to how they infect the target system. A terminate-and-stay resident virus remains in memory until the system is restarted. A transient virus has a life that depends on its host. When its attached program ends, the virus terminates. A companion virus has the identical file name as the target program file. As soon as the particular program is executed, the virus infects the computer. Polymorphic viruses change their characteristics to evade antivirus programs. Stealth viruses alter and corrupt service call interrupts when they are being run. When a request to perform an operation involves these service calls, the virus interrupts and replaces that call.

Cavity viruses fill the empty spaces of a program and are more difficult virus to write. Tunneling viruses attempt installation beneath the antivirus program by intercepting the interrupt handlers of the operating system and evade detection. Camouflage viruses cover themselves as genuine applications and are easily traced by antivirus programs. There are also bootable CD-ROM viruses that can enter a system by being loaded on a CD-ROM.

Self-Modification Viruses

Antivirus programs scan for patterns or a virus signature, a byte that is part of the virus. If a pattern match is found, the antivirus program flags that file as infected. With self-modification viruses, the code is modified upon each infection. Encryption with a variable key uses encryption keys and each infected file uses a different combination of keys. To manipulate freshly executed files, metamorphic code viruses rewrite themselves whereas polymorphic code viruses infect a file with a copy of a polymorphic code that is encrypted.

The Worst Computer Viruses

File Extensions

Countermeasures

A virus scanner is a must-have. After a new virus is discovered, the signature strings of the virus are identified. Your antivirus software must be updated with the new signatures in order to scan your memory files and system sectors. Although virus scanners can check programs before they are executed and are the easiest way to check new software for known viruses, they are a reactive solution.

Integrity checkers read and record integrated data to develop a signature for those files and system sectors. Some are also capable of analyzing the types of changes that viruses make.

Interception looks at requests to the operating system for actions that cause a threat to a program. If it finds a request, the interceptor pops up and asks for user interaction before continuing.

Antivirus Software

Antivirus software (Figure 5-7) needs to be installed, updated, and run to be most effective. There are many options available.

Utilizing Malware

Hackers often use malware programs like Dark Comet to maintain a connection to a victim’s machine. The hacker is then able to perform malicious tasks on the victim over that connection.

In Figure 5-8, Windows 7 is using a public IP address on the WAN. Windows 2003 SQL is NATed behind the firewall, and the firewall is redirecting traffic to SQL.

In Figure 5-9, SQL injection provides a Dark Comet connection to a victim.

Exploiting the Connection

A connection to the victim machine offers a number of possible actions. Once connected to a victim machine, the attacker can manipulate the target machine as though they were sitting behind the keyboard (Figure 5-10).

Summary

Malicious programs are written to benefit the attacker and are created for a multitude of reasons. These programs contain features of viruses, worms, Trojans, and rootkits. In this chapter, you learned the ways Trojans infect a victim’s system, countermeasures, and the ports used by Trojans. You can now identify symptoms of a virus, virus types, and virus detection methods in countermeasures. Lastly, you understand how a virus works and are familiar with the concepts of backdoors and worms.