Detecting trojans on random ports with encrypted traffic...

[Clint Byrum <cbyrum () spamaps org>]

Ok so, we can obviously see sub7 on port 27374 with its known signature
patterns. But then they go and run it on a different port. And then they
go and encrypt things(I don't know if sub7 can do this, but for instance
BO or something else).

The scenario is, a user brings a floppy disk with a trojan on it to the
location, and puts the trojan on another user's computer. They then sit
back and watch the keylogging/passwords/etc.etc.

So, is this what SPADE is supposed to handle? I mean.. currently the
only solution I have come up with is to designate subnets that are not
supposed to be talking to eachother, and alert on peer to peer traffic.
But this isn't always possible, and this doesn't cover traffic where the
trojan is on a server.

Is there any hope to detect this situation?