Incomputing, a Trojan horse (or simply Trojan) is any malware that misleads users of its true intent by disguising itself as a standard program. The term is derived from the ancient Greek story of the deceptive Trojan Horse that led to the fall of the city of Troy.[1]
Trojans are generally spread by some form of social engineering. For example, where a user is duped into executing an email attachment disguised to appear innocuous (e.g., a routine form to be filled in), or by clicking on a fake advertisement on social media or anywhere else. Although their payload can be anything, many modern forms act as a backdoor, contacting a controller who can then have unauthorized access to the affected computer.[2] Ransomware attacks are often carried out using a Trojan.
It was made popular by Ken Thompson in his 1983 Turing Award acceptance lecture "Reflections on Trusting Trust",[6] subtitled: "To what extent should one trust a statement that a program is free of Trojan horses? Perhaps it is more important to trust the people who wrote the software." He mentioned that he knew about the possible existence of Trojans from a report on the security of Multics.[7][8]
Once installed, Trojans may perform a range of malicious actions. Many tend to contact one or more Command and Control (C2) servers across the Internet and await instruction. Since individual Trojans typically use a specific set of ports for this communication, it can be relatively simple to detect them. Moreover, other malware could potentially "take over" the Trojan, using it as a proxy for malicious action.[9]
In German-speaking countries, spyware used or made by the government is sometimes called govware. Govware is typically a Trojan software used to intercept communications from the target computer. Some countries like Switzerland and Germany have a legal framework governing the use of such software.[10][11] Examples of govware Trojans include the Swiss MiniPanzer and MegaPanzer[12] and the German "state Trojan" nicknamed R2D2.[10] German govware works by exploiting security gaps unknown to the general public and accessing smartphone data before it becomes encrypted via other applications.[13]
Due to the popularity of botnets among hackers and the availability of advertising services that permit authors to violate their users' privacy, Trojans are becoming more common. According to a survey conducted by BitDefender from January to June 2009, "Trojan-type malware is on the rise, accounting for 83% of the global malware detected in the world." Trojans have a relationship with worms, as they spread with the help given by worms and travel across the internet with them.[14] BitDefender has stated that approximately 15% of computers are members of a botnet, usually recruited by a Trojan infection.[15]
Recent investigations have revealed that the Trojan horse method has been used as an attack on cloud computing systems. A Trojan attack on cloud systems tries to insert an application or service into the system that can impact the cloud services by changing or stopping the functionalities. When the cloud system identifies the attacks as legitimate, the service or application is performed which can damage and infect the cloud system.[16]
A Trojan horse is a program that purports to perform some legitimate function, yet upon execution it compromises the user's security.[17] A simple example is the following malicious version of the Linux sudo command. An attacker would place this script in a publicly writable directory (e.g., /tmp). If an administrator happens to be in this directory and executes sudo, then the Trojan may execute, compromising the administrator's password.
Having . somewhere in the PATH is convenient, but there is a catch.[19] Another example is the following malicious version of the Linux ls command. However, the filename is not ls; instead, it is sl. An attacker would place this script in a publicly writable directory (e.g., /tmp).
The computer term "Trojan horse" is derived from the legendary Trojan Horse of the ancient city of Troy. For this reason "Trojan" is often capitalized. However, while style guides and dictionaries differ, many suggest a lower case "trojan" for normal use.[30][31]
A Trojan Horse Virus is a type of malware that downloads onto a computer disguised as a legitimate program. The delivery method typically sees an attacker use social engineering to hide malicious code within legitimate software to try and gain users' system access with their software.
The original story of the Trojan horse can be found in the Aeneid by Virgil and the Odyssey by Homer. In the story, the enemies of the city of Troy were able to get inside the city gates using a horse they pretended was a gift. The soldiers hid inside the huge wooden horse and once inside, they climbed out and let the other soldiers in.
A Trojan virus spreads through legitimate-looking emails and files attached to emails, which are spammed to reach the inboxes of as many people as possible. When the email is opened and the malicious attachment is downloaded, the Trojan server will install and automatically run every time the infected device is turned on.
Devices can also be infected by a Trojan through social engineering tactics, which cyber criminals use to coerce users into downloading a malicious application. The malicious file could be hidden in banner advertisements, pop-up advertisements, or links on websites.
A computer infected by Trojan malware can also spread it to other computers. A cyber criminal turns the device into a zombie computer, which means they have remote control of it without the user knowing. Hackers can then use the zombie computer to continue sharing malware across a network of devices, known as a botnet.
For example, a user might receive an email from someone they know, which includes an attachment that also looks legitimate. However, the attachment contains malicious code that executes and installs the Trojan on their device. The user often will not know anything untoward has occurred, as their computer may continue to work normally with no signs of it having been infected.
Trojans can also attack and infect smartphones and tablets using a strand of mobile malware. This could occur through the attacker redirecting traffic to a device connected to a Wi-Fi network and then using it to launch cyberattacks.
A Trojan horse virus can often remain on a device for months without the user knowing their computer has been infected. However, telltale signs of the presence of a Trojan include computer settings suddenly changing, a loss in computer performance, or unusual activity taking place. The best way to recognize a Trojan is to search a device using a Trojan scanner or malware-removal software.
Practicing good cyber hygiene is always the best first line of defense against Trojan viruses and other threats. Keep your operating systems updated and patched, run anti-virus software and allow it to scan your devices regularly, and avoid phishing attacks by carefully inspecting inbound emails.
While browsing the web, pay attention to the URLs displayed in your browser address bar. Also, inspect links before you click on them. And install a privacy or security extension from your browser vendor's extensions store.
A Trojan Horse (Trojan) is a type of malware that disguises itself as legitimate code or software. Once inside the network, attackers are able to carry out any action that a legitimate user could perform, such as exporting files, modifying data, deleting files or otherwise altering the contents of the device. Trojans may be packaged in downloads for games, tools, apps or even software patches. Many Trojan attacks also leverage social engineering tactics, as well as spoofing and phishing, to prompt the desired action in the user.
A Trojan is sometimes called a Trojan virus or Trojan horse virus, but those terms are technically incorrect. Unlike a virus or worm, Trojan malware cannot replicate itself or self-execute. It requires specific and deliberate action from the user.
The 2024 Global Threat Report unveils an alarming rise in covert activity and a cyber threat landscape dominated by stealth. Data theft, cloud breaches, and malware-free attacks are on the rise. Read about how adversaries continue to adapt despite advancements in detection technology.
Fun Fact: Trojans derive their name from the Greek mythical tale, Ulysses, wherein Greek warriors hid inside a hollow wooden horse. Their opponent, the Trojans, thought the horse was a blessing from the gods and brought it inside the city walls, unwittingly unleashing an attack. Much like Trojan horse in the epic, digital adversaries that deploy Trojans often rely on social engineering and trickery to deceive users into downloading and running malicious programs.
Trojans are one of the most common threats on the internet, affecting businesses and individuals alike. While many attacks focused on Windows or PC users in the past, a surge in Mac users has increased macOS attacks, making Apple loyalists susceptible to this security risk. In addition, mobile devices, such as phones and tablets, are also vulnerable to Trojans.
Like a traditional malware attack, mobile Trojan attacks are disguised as legitimate programs, usually as an app or other commonly downloaded item. Many of these files originate from unofficial, pirated app marketplaces and are designed to steal data and files from the device.
In addition, consumers should take steps to protect their devices and prevent them from all types of malware attacks. This means investing in cybersecurity software, which can detect many threats or block them from infecting the device.
The growing sophistication of digital adversaries makes it increasingly difficult for users to properly resolve Trojan attacks on their own. Ideally, if a person suspects that their system has been infected by a Trojan or other type of malware attack, they should contact a reputable cybersecurity professional immediately to help rectify the situation and put proper measures in place to prevent similar attacks from occurring in the future. At a minimum, consumers should download an antivirus program and malware removal service from a reputable provider.
3a8082e126