Re: [Full-disclosure] Re: Microsoft AntiSpyware falling further behind

Valdis.Kletnieks_at_vt.edu
Date: 10/30/05

  • Next message: Lexi: "Re: [Full-disclosure] Funny smtp helo in the logs" 
    To: nick@virus-l.demon.co.uk
Date: Sun, 30 Oct 2005 09:44:25 -0500

    On Sun, 30 Oct 2005 09:46:48 +1300, Nick FitzGerald said:

    > This is a Johnny come lately perversion of the real meaning of Trojan
    > Horse in reference to software. Trojan Horse, or simply Trojan,
    > software has always meant, and still does to anyone with a vague hint
    > of historical awareness, software that gets installed under the
    > pretense of being something desirable or beneficial but that actually
    > has deliberately (on the part of its designer/developer) undesirable
    > effects that are (at least initially) hidden or not obvious to the
    > intended user(s) of the software.

    Which is particularly amusing, given that the Trojan Horse written about by Homer
    was quite specifically a 'remote access Trojan' - a very small number of soldiers
    were hidden inside to open the gates for the main forces. If anything, the
    use of the term to mean "remote access Trojan" is getting back in line with the
    *actual* historical meaning - uses of "Trojan" for non-remote-access back doors
    were in fact not strictly historically correct...

    You'll also notice that I *did* say:

    > and (b) once there, gives the attacker a "back door" into the system, to
    > do unspecified things (run commands, launch DDoS attacks, send spam, scan
         ^^^^^^^^^^^^^^^^^^
    > for other vulnerable software, upload plugins to extend the Trojan's functionality,
    > or whatever).
         ^^^^^^^^

    So I *was*, in fact, covering the 0.001% of trojans in use today that aren't
    strictly a remote-access variant. Meanwhile, the *old* name for what Nick
    wants to call a 'Trojan Horse' was 'trap door' (see Karger&Schell's 1974 paper
    on Multics security - in fact, section 3.4.5.1 of that paper discusses the
    theoretical possibility of a 'compiler trap door', subsequently actually
    implemented by Ken Thompson as discussed in his 1984 Turing Award Lecture "On
    Trusting Trust".

    Interestingly enough, Ken calls his implementation a Trojan Horse:

      "Figure 6 shows a simple modification to the compiler that will deliberately
      miscompile source whenever a particular pattern is matched. If this were not
      deliberate, it would be called a compiler "bug." Since it is deliberate, it
      should be called a "Trojan horse.""

    Additionally, he goes on:

      "The final step is represented in Figure 7. This simply adds a second Trojan
      horse to the one that already exists. The second pattern is aimed at the C
      compiler. The replacement code is a Stage I self-reproducing program that
      inserts both Trojan horses into the compiler. "

    Notice that the second pattern is specifically *not* allowing any remote access,
    but propogating the first pattern. Yet Thompson calls it a Trojan as well.

    Forget it, Nick. You're fighting a battle already lost in 1984. ;)

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Lexi: "Re: [Full-disclosure] Funny smtp helo in the logs"

    Relevant Pages

    • Re: [Full-disclosure] Re: Microsoft AntiSpyware falling further behind
      ... Ken calls his implementation a Trojan Horse: ... intention of its "payload", ... In my mind, there are three important major groups of malware: ...
      (Full-Disclosure)
    • Re: Danger warning! to the public and note to Databaseben
      ... was not the cause of the Trojan Horse, although possibly it could have used it to "sneak" the Trojan Horse onto my computer. ... I saved the quarantine area of Ad-Aware. ... You'll be offered the option upon install, and you can schedule a boot scan from the top/left button on the Control Panel. ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: Linux and viruses, worms, etc (newbie)
      ... > viruses, trojans or worms, there have been worms and trojan horses ... _simultaneously_ too reckless and naive to check package PGP or md5sum ... It's not merely "lucky" that this didn't lead to trojan horse ...
      (alt.os.linux.suse)
    • Re: Start up problem. Hangs. No entry in sys tray except time
      ... Many single trojan file also are protected by its memory image (virus ... need to have a bit of synchronising between ur antivirus actions and ur dos ... [DETECTION] ... Is the Trojan horse TR/Dldr.FFZ.33 ...
      (microsoft.public.windowsxp.accessibility)
    • Re: getting around Ken Thompsons compiler Trojan
      ... >the compiler. ... The recognizer clearly has to perform a fuzzy match, ... >the goal is that the Trojan be propagated to all future versions of the ...
      (comp.security.unix)