Re: What is the difference between a worm and a trojan ?
From: Jay T. Blocksom (not.deliverable+USENET_at_appropriate-tech.net)
Date: 06/03/04
- Next message: kurt wismer: "Re: What is the difference between a worm and a trojan ?"
- Previous message: Jay T. Blocksom: "Re: What is the difference between a worm and a trojan ?"
- In reply to: mike3: "Re: What is the difference between a worm and a trojan ?"
- Next in thread: FromTheRafters: "Re: What is the difference between a worm and a trojan ?"
- Reply: FromTheRafters: "Re: What is the difference between a worm and a trojan ?"
- Reply: Norman L. DeForest: "Re: What is the difference between a worm and a trojan ?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 03 Jun 2004 09:43:32 -0400
[Bogus "Newsgroups:" list fixed]
On 2 Jun 2004 19:29:18 -0700, in <alt.privacy.spyware>, mike4ty4@yahoo.com
(mike3) wrote:
>
[snip]
>
> All viruses, including worms, can replicate once inside a computer.
[snip]
Show me a computer virus or worm (and no, neither is a subset of the other)
which can exist anywhere else *except* "inside a computer". ;-)
> Trojans are just programs that promise one thing but do something
> completely different (and usually something bad) -- for instance a
> program might promise to be a cool game but when executed it wipes
> your hard disk.
[snip]
Correct.
> But they _do_not_replicate_.
[snip]
Objection as to form -- which as you've stated it is misleading, at best.
Any given piece of malware can be (and very often is) *both* a trojan *and* a
worm, or *both* a trojan *and* a virus. For example, most early virii, which
generally used either "sneaker net" (or the local BBS system) as a primary
propagation method, depended on tricking the user into explicitly executing
the malicious code; the virus would then attach itself to some other program,
in hopes of piggy-backing a ride when that other program got passed around.
IOW, this depends purely on the particular malware in question. The closest
you can get to that is to say that self-replication is not an identifying
characteristic of a trojan.
> Viruses (including worms)
> REPLICATE. Trojans do not.
[snip]
No. See above.
> Since a virus and worm are pretty much the
> same thing,
[snip]
Sorry, wrong again.
The key identifying characteristics of a worm, as opposed to a virus, are that
the former does not necessarily have a destructive "payload", other than it's
own wasteful network traffic, and it can propagate in a more-or-less unlimited
fashion with *NO* user intervention whatsoever. [In its purest form, a worm
cannot "infect" a host system; it merely resides on it for some period of time
and wreaks havoc (in the form of bogus network traffic) for as long as it is
permitted to execute. But once the worm process is halted (such as by
re-booting the host system), all is back to normal.]
A virus, OTOH, causes tangible damage (typically in the form of added and/or
altered files) to the host system; and therefore it must be explicitly removed
(and non-corrupted versions of the affected files restored), in order to clear
the "infection". (A trojan can also cause damage, without being a virus; but
it is not *dependant* on this mechanism in order to propagate itself.)
The mildest form of a cross between the two would be a worm which installs
itself on a host system without damaging any other files, or otherwise
altering that system in any way (other than perhaps adding some pointers in
the systems startup config, in order to re-activate the program at boot time).
Then each time the worm's program file was executed, it would swing back into
action. Strictly speaking, this would be a virus; but since it is relatively
"innocuous" (in terms of damage to the host system, at least), it is rather
more "worm-like" in its behavior.
> ...the difference is in the means
> of execution. File viruses simply piggyback on other programs within
> the computer they infect, so they require the user to activate or copy
> these programs to multiply and spread to other computers. Worm viruses
> are 100% self-contained, they do not require piggybacking on another
> program to be executed.
[snip]
No.
As explained above, the key things that makes a virus a virus are that it
*damages* the host system (or a legitimate program residing on that host
system) in some way along the line, *and* that this damage enables the virus
to further propagate itself.
-- Jay T. Blocksom -------------------------------- Appropriate Technology, Inc. usenet01[at]appropriate-tech.net "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -- Benjamin Franklin, Historical Review of Pennsylvania, 1759. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Unsolicited advertising sent to this E-Mail address is expressly prohibited under USC Title 47, Section 227. Violators are subject to charge of up to $1,500 per incident or treble actual costs, whichever is greater. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- Next message: kurt wismer: "Re: What is the difference between a worm and a trojan ?"
- Previous message: Jay T. Blocksom: "Re: What is the difference between a worm and a trojan ?"
- In reply to: mike3: "Re: What is the difference between a worm and a trojan ?"
- Next in thread: FromTheRafters: "Re: What is the difference between a worm and a trojan ?"
- Reply: FromTheRafters: "Re: What is the difference between a worm and a trojan ?"
- Reply: Norman L. DeForest: "Re: What is the difference between a worm and a trojan ?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
