{"id":14981,"date":"2014-07-21T17:45:31","date_gmt":"2014-07-21T17:45:31","guid":{"rendered":"http:\/\/kasperskydaily.com\/b2b\/?p=2257"},"modified":"2020-02-26T10:53:41","modified_gmt":"2020-02-26T15:53:41","slug":"a-healthy-equinophobia-trojan-horses-explained","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/a-healthy-equinophobia-trojan-horses-explained\/14981\/","title":{"rendered":"A healthy equinophobia: Trojan horses explained"},"content":{"rendered":"<p>The cybersecurity term \u201cTrojan\u201d is quite curious in its origin. It has little to do with the citizens of ancient Troy: actually it\u2019s a shortening of \u201cTrojan horse\u201d. Now, that is quite descriptive. As we know since high school, the original Trojan horse was built by Greeks after they sieged Troy for ten fruitless years. The wooden horse \u201cof mountainous size\u201d was left before the gates of the city, and its defenders had a folly to roll it inside, considering this to be a gift. Actually, thirty armed men were hiding inside, and the following night Troy fell.<\/p>\n<p>\u00a0<\/p>\n<p style=\"text-align: center;\">\n<\/p><p>\u00a0<\/p>\n<p>Now, Trojan horse commonly means something seemingly benevolent or at least innocent, while concealing very harmful stuff within.<\/p>\n<p>The point here \u2013 the \u201clegendary\u201d one, in all senses, \u2013 is that victims brought the woe upon themselves, against their better judgement.<\/p>\n<p>In computer security, Trojan horses (or, again, just Trojans) work exactly that way. This sort of malware \u2013 currently, perhaps, the most popular kind \u2013 doesn\u2019t attempt to inject itself into other files (like virii do), doesn\u2019t replicate itself indefinitely (like worms do), and in most cases get through by trickery, which is supposed to be ensuring end-users\u2019 cooperation. The more advanced Trojans, however, may use drive-by download or even drive-by installation, which occurs without users\u2019 knowledge, after all.\u00a0<\/p><blockquote class=\"twitter-pullquote\"><p>Bring a horse-full of trouble upon yourself: computing Trojans still need cooperation.<\/p><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fkas.pr%2FP9r4&amp;text=Bring+a+horse-full+of+trouble+upon+yourself%3A+computing+Trojans+still+need+cooperation.\" class=\"btn btn-twhite\" data-lang=\"en\" data-count=\"0\" target=\"_blank\" rel=\"noopener nofollow\">Tweet<\/a><\/blockquote>\n<p>But, again, in most cases Trojans are infiltrating our systems because we allow them to do just that.<\/p>\n<p>The first (ever) Trojan \u201cin the wild\u201d had been created as early as in 1975, although it was a non-malicious program, but rather a game. In April 1975 John Walker, then-future creator of Autodesk (CAD software, not company) wrote a game ANIMAL for UNIVAC 1108 platform. According to Wikipedia, \u201cANIMAL asked a number of questions of the user in an attempt to guess the type of animal that the user was thinking of, while the related program PERVADE would create a copy of itself and ANIMAL in every directory to which the current user had access. It spread across the multi-user UNIVACs when users with overlapping permissions discovered the game, and to other computers when tapes were shared.\u201d<\/p>\n<p>The program itself did not cause any damage, but its \u201cundercontrolled\u201d propagation really made it look like a malware.<\/p>\n<p>Another early example, this time really harmful, was Trojan \u201cARF-ARF\u201d, which emerged in 1983. The malware claimed to be able to sort DOS Diskette Directory, which was a desirable feature: back then DOS didn\u2019t list the files in alphabetical order in 1983. After the users installed the program (which was distributed via BBS sites), it just deleted all files on the diskette, cleared the screen and typed ARF \u2013 ARF (a reference to a notorious \u201cAbort, Retry, Fail\u201d message).<\/p>\n<p>Trojans really grew into fashion in early 2000s. Broadband connections became more and more accessible, numbers of networked computers grow, the dominating Windows operating systems are vulnerable, and the users are often inexperienced yet. Even though the most fabulous global pandemics just took place \u2013 Melissa worm (1999), ILOVEYOU (2000), AnnaKournikova, Sircam, Code Red, Nimda, Klez (2001). Those are still well-remembered. But not many pepole, apparetly, remember RATs (Remote Administration Tools) such as Beast, emerging in 2002 and later.<\/p>\n<p>Zlob Trojan, however, gained a lot of notoriety: first detected in late 2005, it masqueraded itself as a required video codec in the form of the Microsoft Windows ActiveX component. Apparently, it had Russian origin; an English counterpart for the Russian word \u201czlob\u201d (or, \u201czhlob\u201d), depending on context, would be \u201ca douchebag\u201d or even \u201can a\u2013hole\u201d: a mean person doing mean things just out of malice. That\u2019s exactly what Zlob Trojan did initially. Getting installed, it displayed pop-ups similar to real Microsoft Windows warning, declaring that the PC is infected with spyware, and \u2013 with user\u2019s consent \u2013 installed a fake anti-spyware program (Virus Heat, MS Antivirus\/Antirvirus 2009) with another Trojan horse inside. It was also downloading occasionally atnvrsinstall.exe malware, which used Windows Security shield icon to look legitimate. Installing this could wreak havoc within the network, as another malware that Zlob brings along would shut down random PCs with various comments. \u2018Cause that\u2019s such fun, why?<\/p>\n<p>Otherwise, Zlob is a spamming Trojan.<\/p>\n<p>\u00a0<\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2014\/07\/06020045\/8001-1.jpg\"><img decoding=\"async\" class=\"alignnone size-full wp-image-2258\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2014\/07\/06020045\/8001-1.jpg\" alt=\"800\" width=\"873\" height=\"575\"><\/a><\/p>\n<p>Worse even, Zlob\u2019s \u201cfamily\u201d (or, should I say, \u201cdescendants\u201d) grew into a global problem with <a href=\"https:\/\/securelist.com\/analysis\/publications\/36396\/heads-of-the-hydra-malware-for-network-devices\/#watch-your-dns\" target=\"_blank\" rel=\"noopener\">DNSChanger malware<\/a>, which infected routers and changed their DNS settings to re-route all traffic via malicious hosts. This resulted in a lot of problems for the end users such as unremovable \u201cadult content\u201d pop-ups and banners. Eventually FBI seized the DNSChanger\u2019s host servers, and then had to keep them running for months while broadcasting the messages how to clean up this \u201cbeast\u201d off your PC.<\/p><blockquote class=\"twitter-pullquote\"><p>Trojans: misnamed trouble elevated to a global threat.<\/p><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fkas.pr%2FP9r4&amp;text=Trojans%3A+misnamed+trouble+elevated+to+a+global+threat.\" class=\"btn btn-twhite\" data-lang=\"en\" data-count=\"0\" target=\"_blank\" rel=\"noopener nofollow\">Tweet<\/a><\/blockquote>\n<p>Into a global problem also grew ZeuS: first detected in 2007, this Trojan steals personal information \u2013 first it was a focused banking malware. The source code for ZeuS \u201cleaked\u201d in 2011. Currently it has multiple derivatives those are used to \u201clift\u201d credentials for online social networks, e-mail accounts and financial services.<\/p>\n<p>The \u201cmain\u201d ZeuS botnet used to be one of the largest over the web. Currently experts have to deal with an entire \u201cgalaxy\u201d of botnets based on various ZeuS derivatives, such as <a href=\"https:\/\/securelist.com\/blog\/spam-test\/32471\/a-gift-from-zeus-for-passengers-of-us-airways-10\/\" target=\"_blank\" rel=\"noopener\">Gameover ZeuS<\/a> which uses an encrypted peer-to-peer communication system to communicate between its nodes and its command and control servers which make it especially difficult to root out.<\/p>\n<p>This botnet is largely used for banking fraud and distribution of the <a href=\"https:\/\/securelist.com\/blog\/research\/57311\/cryptolocker-wants-your-money\/\" target=\"_blank\" rel=\"noopener\">CryptoLocker<\/a> ransomware \u2013 which is also a Trojan, by the way.<\/p>\n<p>As we can see, Trojans don\u2019t just come alone, they often bring \u201cfriends\u201d. In numbers, even. Some are easy to \u201cpick up\u201d (especially those using drive-by downloads), and not exactly easy to bust. So aside from keeping your security software updated, it is very advisable to stay vigilant and don\u2019t let anything get installed, unless you are positive it is what you really need right now.<\/p>\n<p>For businesses it is also a requirement to set up an additional protection for financial transactions, such as Kaspersky Lab\u2019s <a href=\"https:\/\/www.google.ru\/url?sa=t&amp;rct=j&amp;q=&amp;esrc=s&amp;source=web&amp;cd=2&amp;cad=rja&amp;uact=8&amp;ved=0CCYQFjAB&amp;url=http%3A%2F%2Fwww.kaspersky.com%2Fdownloads%2Fpdf%2Fkaspersky_lab_whitepaper_safe_money_eng_final.pdf&amp;ei=wy7NU_C4I-rnygOa_4D4Ag&amp;usg=AFQjCNEecgaKeoR34LWeolx7biOf1ChUug&amp;sig2=fSjY06KbIIF2e8zEGLlKfg&amp;bvm=bv.71198958,d.bGQ\" target=\"_blank\" rel=\"noopener nofollow\">Safe Money<\/a>. Safe Money ensures that your money go exactly where you want them, and the malicious interference attempts (via Trojans, Backdoors etc) are futile. Safe Money, among other things, prevent keyloggers from working (which is a weapon of choice for banking Trojans), beat off phishing attempts and secures the connection with the financial services from interception attempts. So it is a necessary (or at least, a highly recommended) protective measure capable of preventing some dire problems.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;Trojan&#8221; in computing is a misleading shortening from the self-descriptive &#8220;Trojan horse&#8221;, the ubiquitous and probably the most dangerous sort of malware.<\/p>\n","protected":false},"author":209,"featured_media":15866,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1999,3052],"tags":[282,36,723],"class_list":{"0":"post-14981","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-business","8":"category-smb","9":"tag-cybersecurity","10":"tag-malware-2","11":"tag-trojans"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/a-healthy-equinophobia-trojan-horses-explained\/14981\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/a-healthy-equinophobia-trojan-horses-explained\/14981\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/a-healthy-equinophobia-trojan-horses-explained\/14981\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/cybersecurity\/","name":"Cybersecurity"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/14981","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/209"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=14981"}],"version-history":[{"count":3,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/14981\/revisions"}],"predecessor-version":[{"id":33249,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/14981\/revisions\/33249"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/15866"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=14981"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=14981"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=14981"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}