full-disclosure - Re: Help put a stop to incompetent computerforensics

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu Aug 11 03:07:34 2005
From: cfullerton at fullertoninfosec.com (Chuck Fullerton)
Subject: Re: Help put a stop to incompetent
	computerforensics

Ok.. In one reply you typed...

"In computers, a Trojan horse is a program in which malicious or harmful
code is contained inside apparently harmless programming or data in such a
way that it can get control and do its chosen form of damage, such as
ruining the file allocation table on your hard disk."

Below you said...

"This is part of why I'm saying that the definition of Trojan must include
the access and control that a backdoor gives."

In your reply to me earlier (First example above), The trojan can do its
damage without giving control to an outside attacker.  That's the difference
between the two.  A backdoor gives access to an outside attacker while a
Trojan doesn't.  It can however use a backdoor combined with the trojan to
deliver access.

Chuck Fullerton

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Jason Coombs
Sent: Wednesday, August 10, 2005 9:34 PM
To: James Tucker
Cc: Full-Disclosure
Subject: Re: [Full-disclosure] Re: Help put a stop to incompetent
computerforensics

James Tucker wrote:
> Sorry, how many programs which you class as "Trojans" add what you 
> define as a "backdoor", given that a "backdoor" is generally 
> pre-compiled code which allows access via previously un-announced or 
> commonly unused connection methods? Malware doesn't typically ADD 
> backdoors, it comes shipped with them, thus the classification 
> Trojan.Backdoor, as opposed to just Trojan. Many of the more common 
> Trojans these days are Worms, Trojans, and Backdoors and some are Viri 
> too. The reason is simple - short of breaking the kernel process 
> scheduler it is useful to be a Trojan when present as an active virus.
> Similarly due to the current nature of desktop and server side 
> application logic, most viri are unsuccessful without being worms - 
> although this may change in a few decades as applications become more 
> data driven and automatic. Nothing will ever substitute a full 
> description of a particular malware's actions in describing what it 
> does, unless you expect malware authors to start conforming to 
> standards.

Applying the broader definition of Trojan, I can't even make sense out of
your paragraph above. But I know that you aren't using the term to
communicate the idea of malware that enables the attacker to gain control
over, and future access to, the infected system ... If that's the definition
you had in mind, then the paragraph you wrote makes logical sense.
Otherwise, not.

I agree that calling it a backdoor isn't comfortable, it just doesn't fit.
This is part of why I'm saying that the definition of Trojan must include
the access and control that a backdoor gives.

It doesn't make sense to me that "Many of the more common Trojans these days
are Worms, Trojans, and Backdoors ..." unless you are using Trojan to
communicate the feature of remote access to the infected box.

Sincerely,

Jason Coombs
jasonc@...ence.org
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/