IT Baseline Protection Manual - The Information Warfare Site

Threats Catalogue Deliberate Acts Remarks
____________________________________________________________________ .........................................
T 5.21 Trojan horses
A Trojan horse is a program with a hidden, undocumented function or effect.
The user therefore has no influence on the execution of that function, making
its effect similar to that of a computer virus. However, unlike computer
viruses, Trojan horses are not self-reproductive. Any kind of application
software can be used as carrier for a Trojan horse. Script languages, like batch
files, ANSI control sequences, Postscript etc., which are interpreted by the
operating system or by an application program, can also have Trojan horses
planted in them.
The more privileges the originator program has, the more damage the Trojan
horse can cause.
Examples
- A modified login program can contain a Trojan horse which sends the
user's user name and password to an aggressor over the network and then
passes it to the correct log-in program. Such Trojan horses have appeared
recently on several online services like AOL or T-Online.
- The Back Orifice program is a client/server application which enables the
client to maintain a Windows PC remotely over the network. In particular,
it is possible for data to be read and written and also for programs to be
executed. There is a risk that this program could be integrated into another
application program and thus used as a Trojan horse. If the Trojan horse
starts up when there is a network connection, then an adversary can use the
remote maintenance function of Back Orifice to gain access to the user's
PC unnoticed. The NetBUS program, which has similar functions, should
also be mentioned here.
- It is possible using root kits for different UNIX variants which contain
manipulated versions of the programs ps, who, netstat etc. to keep so-called
back doors open for prolonged periods, allowing penetration of the system
to go unnoticed so that traces of the attack are covered up. Often the files
/sbin/in.telnetd, /bin/login, /bin/ps, /bin/who, /bin/netstat and the C
Libraries are replaced in this way.
- Another source of danger in UNIX systems is the "." in the $PATH
environment variable. If the current working directory (.) is included as a
path in the PATH variable, the programs located there are executed first.
Thus, while listing of the contents of a directory the superuser could
unintentionally execute a modified "ls" program with root rights contained
there.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Application programs
and script languages
Altered login programs
Back Orifice and NetBUS
Manipulated programs
and libraries
Current directory in the
search path