Trojan network threat.

GFI have released a white paper to help network administrators tackle the growing problem of Trojans, which are increasingly being used to steal credit card data, passwords, and other sensitive information, and to launch electronic attacks against targeted organizations. The white paper outlines what Trojans are, why they pose a danger to corporate networks, and how to protect against them. It can be viewed at www.gfi.com/mailsecurity/wptrojans.htm.

What a Trojan is and why it poses a threat to organizations

A Trojan horse is used to enter a victim's computer undetected, granting the attacker unrestricted access to the data stored on that computer. A Trojan can be a hidden program that runs on the victim's computer without his knowledge, or it can be 'wrapped' into a legitimate program, which includes hidden functions of which the victim is unaware. In the corporate world, Trojans are mainly used to siphon off confidential information (industrial espionage,) or to create damage. GFTs white paper describes the seven main types of Trojan and explains how a network can be infected by a Trojan via an email attachment or a downloaded file.

Why an anti-virus engine does not provide all the protection required

Protection against Trojans is a must. Yet, basic security software such as an anti-virus engine does not provide an adequate safeguard against Trojans: the paper explains that although most virus scamers detect some public/known Trojans, they are unable to scan unknown Trojans. This is because anti-virus software relies mainly on recognizing the "signatures" of each Trojan. Yet, because the source code of many Trojans is easily available, a more advanced hacker can create a new version of a Trojan, the signature of which is unknown to any anti-virus scanner.

If the person planning to attack you finds out what anti-virus software you use, for example through the automatic disclaimer added to outgoing emails by some anti-virus engines, he will then create a Trojan specifically to bypass your virus scanner engine, the white paper points out. Also, apart from failing to detect unknown Trojans, virus scanners do not detect all known Trojans either--most virus vendors do not actively seek new Trojans, and research has shown that virus engines each detect a particular set of Trojans.

How to protect a network from Trojans

The white paper proposes that to detect Trojans, one must use a multi-level strategy and deploy multiple virus scanners at the gateway, which would increase the percentage of known Trojans caught; and use content security with executable analysis to detect potentially malicious executables, analyse what they might do and prevent unknown Trojans from entering the network.

Detecting unknown Trojans can he done by manually reviewing each incoming executable; yet this is a tedious and time-intensive job, that can he subject to human error. Therefore it is better to automate the process by means of a Trojan and executable scanner that can intelligently analyze what each executable does and how dangerous it is. A Trojan and executable analyzer disassembles the executable and detects in real time what it might do. It compares these actions to a database of malicious actions and then rates the risk level of the executable. This way, potent/ally dangerous, unknown or one-off Trojans may be detected. www.gfi.com/dsec/