Full Disclosure mailing list archives
RE: Re: Help put a stop to incompetent computerforensics
From: "Chuck Fullerton" <cfullerton () fullertoninfosec com>
Date: Wed, 10 Aug 2005 22:07:26 -0400
Ok.. In one reply you typed... "In computers, a Trojan horse is a program in which malicious or harmful code is contained inside apparently harmless programming or data in such a way that it can get control and do its chosen form of damage, such as ruining the file allocation table on your hard disk." Below you said... "This is part of why I'm saying that the definition of Trojan must include the access and control that a backdoor gives." In your reply to me earlier (First example above), The trojan can do its damage without giving control to an outside attacker. That's the difference between the two. A backdoor gives access to an outside attacker while a Trojan doesn't. It can however use a backdoor combined with the trojan to deliver access. Chuck Fullerton -----Original Message----- From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of Jason Coombs Sent: Wednesday, August 10, 2005 9:34 PM To: James Tucker Cc: Full-Disclosure Subject: Re: [Full-disclosure] Re: Help put a stop to incompetent computerforensics James Tucker wrote:
Sorry, how many programs which you class as "Trojans" add what you define as a "backdoor", given that a "backdoor" is generally pre-compiled code which allows access via previously un-announced or commonly unused connection methods? Malware doesn't typically ADD backdoors, it comes shipped with them, thus the classification Trojan.Backdoor, as opposed to just Trojan. Many of the more common Trojans these days are Worms, Trojans, and Backdoors and some are Viri too. The reason is simple - short of breaking the kernel process scheduler it is useful to be a Trojan when present as an active virus. Similarly due to the current nature of desktop and server side application logic, most viri are unsuccessful without being worms - although this may change in a few decades as applications become more data driven and automatic. Nothing will ever substitute a full description of a particular malware's actions in describing what it does, unless you expect malware authors to start conforming to standards.
Applying the broader definition of Trojan, I can't even make sense out of your paragraph above. But I know that you aren't using the term to communicate the idea of malware that enables the attacker to gain control over, and future access to, the infected system ... If that's the definition you had in mind, then the paragraph you wrote makes logical sense. Otherwise, not. I agree that calling it a backdoor isn't comfortable, it just doesn't fit. This is part of why I'm saying that the definition of Trojan must include the access and control that a backdoor gives. It doesn't make sense to me that "Many of the more common Trojans these days are Worms, Trojans, and Backdoors ..." unless you are using Trojan to communicate the feature of remote access to the infected box. Sincerely, Jason Coombs jasonc () science org _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Re: Help put a stop to incompetent computer forensics, (continued)
- Re: Re: Help put a stop to incompetent computer forensics Thierry Zoller (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Thierry Zoller (Aug 10)
- Message not available
- Re: Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Erik Kamerling (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Thierry Zoller (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Technica Forensis (Aug 10)
- Message not available
- Re: Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- RE: Re: Help put a stop to incompetent computerforensics Chuck Fullerton (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Thierry Zoller (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics J.A. Terranson (Aug 12)
- Re: Re: Help put a stop to incompetent computer forensics Donald J. Ankney (Aug 10)
- RE: Re: Help put a stop to incompetent computerforensics hummer (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- RE: Re: Help put a stop to incompetent computerforensics Chuck Fullerton (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Nick FitzGerald (Aug 11)
- Re: Re: Help put a stop to incompetent computer forensics Blue Boar (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Technica Forensis (Aug 10)