Full Disclosure mailing list archives
Re: Re: Help put a stop to incompetent computer forensics
From: Jason Coombs <jasonc () science org>
Date: Wed, 10 Aug 2005 15:34:07 -1000
James Tucker wrote:
Sorry, how many programs which you class as "Trojans" add what you define as a "backdoor", given that a "backdoor" is generally pre-compiled code which allows access via previously un-announced or commonly unused connection methods? Malware doesn't typically ADD backdoors, it comes shipped with them, thus the classification Trojan.Backdoor, as opposed to just Trojan. Many of the more common Trojans these days are Worms, Trojans, and Backdoors and some are Viri too. The reason is simple - short of breaking the kernel process scheduler it is useful to be a Trojan when present as an active virus. Similarly due to the current nature of desktop and server side application logic, most viri are unsuccessful without being worms - although this may change in a few decades as applications become more data driven and automatic. Nothing will ever substitute a full description of a particular malware's actions in describing what it does, unless you expect malware authors to start conforming to standards.
Applying the broader definition of Trojan, I can't even make sense out of your paragraph above. But I know that you aren't using the term to communicate the idea of malware that enables the attacker to gain control over, and future access to, the infected system ... If that's the definition you had in mind, then the paragraph you wrote makes logical sense. Otherwise, not.
I agree that calling it a backdoor isn't comfortable, it just doesn't fit. This is part of why I'm saying that the definition of Trojan must include the access and control that a backdoor gives.
It doesn't make sense to me that "Many of the more common Trojans these days are Worms, Trojans, and Backdoors ..." unless you are using Trojan to communicate the feature of remote access to the infected box.
Sincerely, Jason Coombs jasonc () science org _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Thierry Zoller (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Thierry Zoller (Aug 10)
- Message not available
- Re: Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Erik Kamerling (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Thierry Zoller (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Technica Forensis (Aug 10)
- Message not available
- Re: Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- RE: Re: Help put a stop to incompetent computerforensics Chuck Fullerton (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Thierry Zoller (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics J.A. Terranson (Aug 12)
- Re: Re: Help put a stop to incompetent computer forensics Donald J. Ankney (Aug 10)
- RE: Re: Help put a stop to incompetent computerforensics hummer (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Jason Coombs (Aug 10)
- RE: Re: Help put a stop to incompetent computerforensics Chuck Fullerton (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Nick FitzGerald (Aug 11)
- Re: Re: Help put a stop to incompetent computer forensics Blue Boar (Aug 10)
- Re: Re: Help put a stop to incompetent computer forensics Technica Forensis (Aug 10)
- <Possible follow-ups>
- RE: Re: Help put a stop to incompetent computer forensics Richard Golodner (Aug 10)