Trojan horse has become an umbrella term for many types of malicious code
|
In January of this year, the Trojan horse (or simply trojan) known as Emotet was disrupted thanks to a coordinated international effort, which included authorities from both sides of the Atlantic. Since originating as a banking trojan in 2014, it has gone on to wreak havoc across millions of devices. It was even developed into an ‘attack for hire’ service offered to other criminal gangs, allowing them to install different types of malicious material onto devices. Last year alone, which saw many records smashed in terms of the number of cyberattacks (as criminals sought to exploit the pandemic), the use of Emotet increased a staggering 4000%.1 The costs associated with this trojan have also been astronomical, with a report from the US Homeland Security quoting up to $1 million per incident to remediate.2 Therefore, it is no wonder that Europol described Emotet as being one of the “most professional and long-lasting cybercrime services out there”.3 But what exactly is a trojan, and what is it about them that makes them so dangerous? Show 
What is a trojan?For those living outside of the IT bubble, you may be familiar with the term trojan, but are unaware of how it differs from, say, a virus or a worm, or perhaps what features about it make it so incredibly dangerous? Firstly, a quick history lesson. Many of us are likely aware of the Greek myth of the Trojan horse, introduced by the Greek poet Homer, over 2000 years ago, in which, to end the ongoing ten-year siege on the city of Troy, the Greeks offered the city a wooden horse; supposedly as a peace offering. However, a force of Greek soldiers within the horse snuck out at night and destroyed the city. If we fast forward to modern-day, computer trojans, in a similar vein, operate in the same way by pretending to be legitimate software. They act as bait, with cybercriminals using social engineering tactics to manipulate users into allowing the trojan easy access into the network to release its malicious code. “A computer
program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorisations of a system entity that invokes the program.” Trojans come in all shapes and sizes, from banking trojans designed to gain access to online banking applications to trojans that spy on the user, track keystrokes, make screenshots, etc. The end goal is to steal information, extract money or exploit the victim. Trojans can therefore be viewed as an umbrella term for malware delivery,4 which hackers use for various threats (e.g. ransomware attacks, file deletion, information theft). The reasons behind these kinds of attacks are varied, from politically motivated attacks, corporate espionage, resource theft or nation-state sponsored cyberwarfare, to name a few. However, most attacks continue to be primarily financially motivated, with cybercrime being an incredibly profitable business, with high-end cybercriminals making $166,000 plus per year!5
How does a trojan work?There are several ways in which a trojan can infect a device; the common theme throughout each method is that they require interaction from the victim to complete the attack, much like how the inhabitants of Troy pulled the horse into the city. This is also why social engineering is such a big part of trojan attacks. After all, it is easier to target the weakest entry point, the human, than trying to hack a network directly. Some examples of how trojans make their way onto devices include:
Once the user has clicked and downloaded the malware, it will reside undetected until the user carries out a specific action (e.g. visiting a banking website), whatever the trojan has been designed to execute. A trojan may spread by turning the host computer into a ‘zombie’ where the victim has no idea that their device is controlled by someone else. The zombie device spreads further malware to other devices and creates a network of zombie computers, known as a ‘botnet’. But it isn’t just computers that trojans can infect; devices such as smartphones and tablets are also susceptible to these kinds of attacks. With Emotet, many infections spread through sophisticated phishing campaigns and targeted specifically Windows-based systems. One high-profile victim of this attack was the Chilean bank Consorcio, which led to $2 million in damages. Another victim was the town of Allentown, in Pennsylvania, who suffered $1 million worth of damages.
Trojan versus VirusTo those unfamiliar with this topic, you may understand the terms trojan and virus to be one of the same. Perhaps you have even come across the (technically incorrect) term ‘trojan virus’? While both can be considered a form of malware, they both possess distinct features that separate them from one another, from their method of delivery, how they interact with the host and even the speed at which they operate. The two most distinct features worth mentioning are:
How to spot a trojanTrojan horses are complex in that they can remain on your device undetected for a long time without the user being aware. Then, once it has completed its intended task (e.g. logging keystrokes to steal login data), it may delete itself, return to a dormant state, or continue to be active on the device.6 However, some signs that you have become a victim of a trojan horse attack include:
How to protect yourselfAs previously mentioned, the trojan cannot manifest without interaction from the end-user, e.g. by downloading a malicious file, clicking a malicious link etc. Therefore, cybercriminals rely heavily on social engineering to trick users into ensuring the attack is successful. As over 90% of malware is still delivered via email, learning how to detect a phishing email will go a long way to ensure you stay protected. Remember:
Being aware of the threats and learning how to spot a phishing email is a good starting point for improving your cybersecurity defences, but it is by no means a panacea. Ensuring that you keep regular and multiple backups and frequently scanning your device for malware are also important. Ensuring you download apps and software from reputable sources is another way to prevent becoming victims of this kind of attack. Remember that all unsolicited communication should be treated with healthy suspicion. With 2018 alone seeing a 239% year on year uptick in incidents relating to banking trojans7 and cybercrime looking to cost the world $10.5 trillion annually by 20258, the problem does not look to be going away anytime soon. So take extra care when using the internet or interacting with emails and remember that if something seems too good to be true, it probably is! Can Trojan horses be termed as a computer program?In computing, a Trojan horse is a program downloaded and installed on a computer that appears harmless, but is, in fact, malicious. Unexpected changes to computer settings and unusual activity, even when the computer should be idle, are strong indications that a Trojan is residing on a computer.
Why is Trojan horse malware called so?In computing, a Trojan horse is any malware that misleads users of its true intent. The term is derived from the Ancient Greek story of the deceptive Trojan Horse that led to the fall of the city of Troy.
What is a Trojan horse give example of malware?A user visits a legitimate website infected with malicious code (for example, malvertising or cross-site scripting) A user downloads a program whose publisher is unknown or unauthorized by organizational security policies. Attackers install a trojan by exploiting a software vulnerability, or through unauthorized access.
What Trojan horse?Trojan Horse refers to a wooden horse said to have been used by the Greeks, during the Trojan War, to enter the city of Troy and win the war. There is no Trojan Horse in Homer's Iliad, with the poem ending before the war is concluded, and it is only briefly mentioned in the Odyssey.
|
