full-disclosure - Re: Help put a stop to incompetent computerforensics

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <42FAA9C9.1030704@science.org>
Date: Thu Aug 11 02:27:54 2005
From: jasonc at science.org (Jason Coombs)
Subject: Re: Help put a stop to incompetent
	computerforensics

Chuck Fullerton wrote:
> "A Trojan horse is a program that appears to have some useful or benign
> purpose, but really masks some hidden malicious functionality."
> 
> "A Backdoor is a program that allows attackers to bypass normal security
> controls on a system, gaining access on the attacker's own terms." 

Here's an example of a completely flawed explanation of the origin of 
the term. The definition given claims that the warriors emerged from the 
horse and only those warriors overran the city. Obviously that isn't 
what happened in the Iliad, the Trojan Horse was used to get further 
access for other warriors. Furthermore, "overran the city" means of 
course that the Trojan Horse was used for the purpose of gaining control 
of the city, regardless of which warriors accomplished the objective.

Most (but not all) of you are suggesting that the only thing that 
matters is what the definitions say, and that's not the right way to 
look at this issue. A program that does something malicious when used is 
not a Trojan unless its malicious purpose fits with the story of the 
Trojan Horse as it is understood by non-computer people. This is why we 
don't call spyware Trojans any longer -- a distinction has been drawn, 
and that distinction has overrun the past usage of the term.

http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci213221,00.html

In computers, a Trojan horse is a program in which malicious or harmful 
code is contained inside apparently harmless programming or data in such 
a way that it can get control and do its chosen form of damage, such as 
ruining the file allocation table on your hard disk. In one celebrated 
case, a Trojan horse was a program that was supposed to find and destroy 
computer viruses. A Trojan horse may be widely redistributed as part of 
a computer virus.

The term comes from Greek mythology about the Trojan War, as told in the 
Aeneid by Virgil and mentioned in the Odyssey by Homer. According to 
legend, the Greeks presented the citizens of Troy with a large wooden 
horse in which they had secretly hidden their warriors. During the 
night, the warriors emerged from the wooden horse and overran the city.