All the latest UK technology news, reviews and analysis
|
|
|
05 Nov 2001
Security watchers have warned that Trojan programs, feared for their ability to compromise a network and go unnoticed, are getting sneakier about sending data out of the network.
Typically, Trojans sit on a compromised machine and wait for incoming connections to deliver instructions.
Further reading
But this leaves a flaw in the Trojan's functionality: all unnecessary ports can be blocked so that incoming connections are dropped and the Trojan is rendered useless.
But Michael DeMaria, of Syracuse University Labs, said that a new method of Trojan programming is being used to get around port blocking and intrusion detection, by making an outbound connection to an already compromised machine using legitimate network traffic.
A proof of concept Trojan called Sheepshank has been recently created. This program makes a basic 'get' request to a web server just like a browser does, but the web page picked up could be configured so that the Trojan picks up keywords containing instructions.
As an example, DeMaria said that a page could be built like '<html> <body>clearwallpaper