Ok.. In one reply you typed... "In computers, a Trojan horse is a program in which malicious or harmful code is contained inside apparently harmless programming or data in such a way that it can get control and do its chosen form of damage, such as ruining the file allocation table on your hard disk."
Below you said... "This is part of why I'm saying that the definition of Trojan must include the access and control that a backdoor gives." In your reply to me earlier (First example above), The trojan can do its damage without giving control to an outside attacker. That's the difference between the two. A backdoor gives access to an outside attacker while a Trojan doesn't. It can however use a backdoor combined with the trojan to deliver access. Chuck Fullerton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jason Coombs Sent: Wednesday, August 10, 2005 9:34 PM To: James Tucker Cc: Full-Disclosure Subject: Re: [Full-disclosure] Re: Help put a stop to incompetent computerforensics James Tucker wrote: > Sorry, how many programs which you class as "Trojans" add what you > define as a "backdoor", given that a "backdoor" is generally > pre-compiled code which allows access via previously un-announced or > commonly unused connection methods? Malware doesn't typically ADD > backdoors, it comes shipped with them, thus the classification > Trojan.Backdoor, as opposed to just Trojan. Many of the more common > Trojans these days are Worms, Trojans, and Backdoors and some are Viri > too. The reason is simple - short of breaking the kernel process > scheduler it is useful to be a Trojan when present as an active virus. > Similarly due to the current nature of desktop and server side > application logic, most viri are unsuccessful without being worms - > although this may change in a few decades as applications become more > data driven and automatic. Nothing will ever substitute a full > description of a particular malware's actions in describing what it > does, unless you expect malware authors to start conforming to > standards. Applying the broader definition of Trojan, I can't even make sense out of your paragraph above. But I know that you aren't using the term to communicate the idea of malware that enables the attacker to gain control over, and future access to, the infected system ... If that's the definition you had in mind, then the paragraph you wrote makes logical sense. Otherwise, not. I agree that calling it a backdoor isn't comfortable, it just doesn't fit. This is part of why I'm saying that the definition of Trojan must include the access and control that a backdoor gives. It doesn't make sense to me that "Many of the more common Trojans these days are Worms, Trojans, and Backdoors ..." unless you are using Trojan to communicate the feature of remote access to the infected box. Sincerely, Jason Coombs [EMAIL PROTECTED] _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
