Trojans and Backdoors

Trojans and backdoors are types of malware used to infect and compromise computer systems. A Trojan is a malicious program disguised as something benign. In many cases the Trojan appears to perform a desirable function for the user but actually allows a hacker access to the user's computer system. Trojans are often downloaded along with another program or software package. Once installed on a system, they can cause data theft and loss, as well as system crashes or slowdowns. Trojans can also be used as launching points for other attacks, such as distributed denial of service (DDoS). Many Trojans are used to manipulate files on the victim computer, manage processes, remotely run commands, intercept keystrokes, watch screen images, and restart or shut down infected hosts. Sophisticated Trojans can connect themselves to their originator or announce the Trojan infection on an Internet Relay Chat (IRC) channel.

Trojans ride on the backs of other programs and are usually installed on a system without the user's knowledge. A Trojan can be sent to a victim system in many ways, such as the following:

• An instant messenger (IM) attachment
• IRC
• An email attachment
• NetBIOS file sharing
• A downloaded Internet program

Many fake programs purporting to be legitimate software such as freeware, spyware-removal tools, system optimizers, screensavers, music, pictures, games, and videos can install a Trojan on a system just by being downloaded. Advertisements on Internet sites for free programs, music files, or video files lure a victim into installing the Trojan program; the program then has system-level access on the target system, where it can be destructive and insidious.

Table 1 lists some common Trojans and their default port numbers.

Table 1: Common Trojan programs 

Trojan	Protocol	Port
BackOrifice	UDP	31337 or 31338
Deep Throat	UDP	2140 and 3150
NetBus	TCP	12345 and 12346
Whack-a-Mole	TCP	12361 and 12362
NetBus 2	TCP	20034
GirlFriend	TCP	21544
Master's Paradise	TCP	3129, 40421, 40422, 40423, and 40426

A backdoor is a program or a set of related programs that a hacker installs on a target system to allow access to the system at a later time. A backdoor can be embedded in a malicious Trojan. The objective of installing a backdoor on a system is to give hackers access into the system at a time of their choosing. The key is that the hacker knows how to get into the backdoor undetected and is able to use it to hack the system further and look for important information.

Adding a new service is the most common technique to disguise backdoors in the Windows operating system. Before the installation of a backdoor, a hacker must investigate the system to find services that are running. Again the use of good information-gathering techniques is critical to knowing what services or programs are already running on the target system. In most cases the hacker installs the backdoor, which adds a new service and gives it an inconspicuous name or, better yet, chooses a service that's never used and that is either activated manually or completely disabled.

This technique is effective because when a hacking attempt occurs the system administrator usually focuses on looking for something odd in the system, leaving all existing services unchecked. The backdoor technique is simple but efficient: the hacker can get back into the machine with the least amount of visibility in the server logs. The backdoored service lets the hacker use higher privileges—in most cases, as a System account.

Remote Access Trojans (RATs) are a class of backdoors used to enable remote control over a compromised machine. They provide apparently useful functions to the user and, at the same time, open a network port on the victim computer. Once the RAT is started, it behaves as an executable file, interacting with certain Registry keys responsible for starting processes and sometimes creating its own system services. Unlike common backdoors, RATs hook themselves into the victim operating system and always come packaged with two files: the client file and the server file. The server is installed in the infected machine, and the client is used by the intruder to control the compromised system.

RATs allow a hacker to take control of the target system at any time. In fact one of the indications that a system has been exploited is unusual behavior on the system, such as the mouse moving on its own or pop-up windows appearing on an idle system.

---

A Word of Caution about Practicing with Trojans

I intentionally left any step-by-step exercises out of this section on Trojans and backdoors because I do not want to advocate anyone installing them on production systems and experiencing loss of data. However, the best way to learn how to use these tools and their capabilities is to install them and test them out. So here is my recommendation to learn ethical hacking skills using Trojans and backdoors.

Take an older computer that you do not have any intention of using again, or buy a second hard drive for your laptop (this is what I did). Install the Windows XP operating system with no service packs or updates enabled. Do not install any virus scanning or firewall. The next step is to really go crazy installing all the Trojans, rootkits, and backdoors tools listed in this chapter. This will give you the freedom to learn and test the tools without being blocked by a virus scan or personal firewall trying to protect your computer. Once you are finished, you can either reinstall Windows or just switch out the hard drive for your production drive.

A final suggestion if you are looking for a small, inexpensive computer to use as a test machine is to purchase an inexpensive netbook that runs Windows XP and use it to install and test tools.

---