Valdis.Kletnieks@vt.edu wrote:
Which is particularly amusing, given that the Trojan Horse written about by
Homer
was quite specifically a 'remote access Trojan' - a very small number of
soldiers
were hidden inside to open the gates for the main forces. If anything, the
use of the term to mean "remote access Trojan" is getting back in line with the
*actual* historical meaning - uses of "Trojan" for non-remote-access back doors
were in fact not strictly historically correct...
You'll also notice that I *did* say:
<snip>
So I *was*, in fact, covering the 0.001% of trojans in use today that aren't
strictly a remote-access variant. Meanwhile, the *old* name for what Nick
wants to call a 'Trojan Horse' was 'trap door' (see Karger&Schell's 1974 paper
on Multics security - in fact, section 3.4.5.1 of that paper discusses the
theoretical possibility of a 'compiler trap door', subsequently actually
implemented by Ken Thompson as discussed in his 1984 Turing Award Lecture "On
Trusting Trust".
Interestingly enough, Ken calls his implementation a Trojan Horse:
"Figure 6 shows a simple modification to the compiler that will deliberately
miscompile source whenever a particular pattern is matched. If this were not
deliberate, it would be called a compiler "bug." Since it is deliberate, it
should be called a "Trojan horse.""
Additionally, he goes on:
"The final step is represented in Figure 7. This simply adds a second Trojan
horse to the one that already exists. The second pattern is aimed at the C
compiler. The replacement code is a Stage I self-reproducing program that
inserts both Trojan horses into the compiler. "
Notice that the second pattern is specifically *not* allowing any remote access,
but propogating the first pattern. Yet Thompson calls it a Trojan as well.
Forget it, Nick. You're fighting a battle already lost in 1984. ;)
I'm forced to disagree with you Valdis.
First, I'll deal with the Homer reference: "Trojan Horse", in the
story, refers to the horse itself that housed the soldiers. The
particular *use* of the horse was not to open a backdoor, that was the
intention of its "payload", the soldiers inside the horse.
The horse itself had one sole duty: to trick the trojans.
That's all it had to do. They could have put a bomb in there for all
intents and purposes and it still would have been a Trojan Horse,
obviously. No back door required, just a burning city.
So, much like all analogies in network security, people take this one
too far. No offense meant here, but reading the story so literally and
comparing that to the term is, in my opinion, a misreading of the story.
Secondly, Nick wasn't saying that Trojan Horses can't refer to code
which drops backdoors, rather that that's not all they are. Frankly,
the Ken Thompson lecture you cited *proves* his point as the Trojan does
not open up a back door.
In my mind, there are three important major groups of malware: Virus,
Trojan, and Worm.
*ALL* forms of malware tend to match at least one of these subgroupings
in their design and operation. All that separates the groups therein
are payloads which cause them to do different things. (I am not listing
manual exploit code as its use is obvious.)
Viruses are file/exec infectors (including boot sectors and anything
that executes). Trojans are programs requiring manual execution
intended to deceive. And worms spread on their own accord via network
means.
Spyware, backdoors, keyloggers, and other malware payloads are all
dropped by one of these types of packages. Spyware drops its payload
often through websites with malicious code on it. This, in my mind,
consistutes a trojan as the deceptive website draws the target in for
silent installation. E-mail "viruses" are trojans in my book because
the deceptive e-mail is the draw.
If we start coming up with arbitrary and restrictive taxonomy for the
different "types" of malware, we're going to harm our ability to deal
with them. I think it's very important that we keep the major strata of
malware from becoming too specific in its meaning.
-bkfsec
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
