Description of Trojan Attacks

Trojan

Abstract—The amount of electronic devices associated with the internet is constantly on the rise, with increasing number of devices there is also an expansion in the number of cyber threats. In this paper, we discuss about Trojan horse which is said to be one of the serious threats to computer security. We discuss about description of trojans, exploits of trojans. It is  important to take preventive measures against trojans.

Keywords—Trojans, Cybersecurity, Attacks, Defense, Hacker

I.                         Introduction

Trojan is a type of malware [1] which is often come seen as a legitimate software.  Hackers/Cyber criminals utilize them to bait them into stacking and executing trojans on their frameworks. Upon actuation cyber criminals the target framework is monitored for retrieving sensitive data and gaining secondary access to one’s framework. Upon gaining access they can perform data deletion, block users data, modify, copy and disrupting the performance of computers or computer networks [1]. Unlike computer viruses and worms, Trojans does not self-replicate. They come as an innocuous programming. Normally Trojans are offered as breaks or keygens, something which ought not be called safe, but rather clients fall prey to downloading them as they feel it is helpful.

Opening your framework to more damage is likewise a wide field of potential outcomes on the grounds that there are numerous sorts of Trojans — the majority of them named after their principle work. It would be ideal if you take note of that it isn’t phenomenal for Trojans to have various capacities and the meaning of Trojans isn’t limited and is available to exchange, so the rundown will never be finished.

II.                  Working

The victim receives a phishing email which closely resembles the original official-looking email with an attachment included. The malicious code being present in the attachment is executed as soon as the victim clicks on it. The system behaves normally and does not arise suspicion. Until a specific date or an action, the malicious code remains dormant undetected in the system. At the instance when the target visits a specific site for example an online financial balance ,the malignant code is activated and does the intended activity. The functionality of the trojan varies-either it deletes itself, continues to remain in the dormant state or remains active.

                        Fig1[5]                Trojan working

III.                Types of trojans

• Trojan-Downloader [1]:New version of malware are downloaded and installed by this type of trojan.
• Trojan-Droppers [1]:Malware are installed on a system which remains unnoticed by the help of complex programs. Droppers go undetected as malicious by most antivirus , hence, they are used to installing viruses.
• Ransomware [1]: The target computer/system’s data is encrypted by this type of trojans. The cyber criminals owning the ransomware would demand a ransom for providing the decryption key. Data recovery without the decryption key is very tough. On receiving the money the criminal consents to send a program that can reinstate  the data or the computer’s normal performance. The WannaCry and Petya were recent ransomware attacks. Cyber security experts advice users to follow a sound and methodical backup and recovery policy
• Trojan-Banker [1]:this type malware programs extracts account-related information such as debit/credit card etc.
• Trojan-Rootkits [1]: these prevent the detection of malware and malicious activities on the computer. These are complex malware which provides access to the target device. Victim’s device is enrolled as part of a botnet by the Rootkits.
• Trojan-Backdoor [1]:is a popular and the most widespread type of Trojan. A backdoor is created which allows cyber criminals to gain complete access of the computer remotely using a remote access tool (RAT). As this Trojan provides complete control over the computer such as sending, receiving, deleting and rebooting files on the computer, backdoor Trojans are for the most part utilized by programmers to hack into a bunch of infected systems to build a zombie chain or malignant botnet that can be utilized for criminal objectives.
• Destructive Trojans [1]: these type of trojans simply destructs the targets data for the sake of creating havoc.
• Security software disabler [1]: these Trojans are configured in such a way that the security programs are eliminated which makes a system without a firewall, Audio Visual Security, Host Intrusion Prevention System or other protection. The main aim is to make the user’s system vulnerable to net level of the attack.
• Trojan-Arc Bomb [1]: these usually intend to  slow down and hamper the mail servers. The Trojans objective is to reduce performance or wrack up a computer by packing tremendous amount of records in a relatively small package. When it is opened, the volume increase is so enormous that the server has to devote a significant quantity of its CPU time and drive space to dealing with the Trojan.
• Trojan SMS [1]: here the mobile devices are targeted by these type of Trojans. Short Message Services are being utilized to send and intercept messages. They  send text messages to arbitrary  numbers and gets cash for the proprietor of the Trojan.
• DDoS attack [1]: In this the cyber criminals taint a great amount of computers with this type of trojans beforehand (for instance, as part of a mass spam mailing). Due to this, every infected computers will attack the target machine/server/site at the signal initiated by the controller. Vast gatherings of system’s under control along these lines are frequently referred to a botnets.
•  Trojan Clicker [1]: used to perform online activities  with the end goal to help hit-check 
• Proxy Trojan [1]: the target PC is transformed into an intermediary so the administrator can perform online business namelessly.
• Mailfinder Trojans [1]: these collect email addresses from the contaminated PC in any capacity they can and send the rundown of addresses to the administrator.

IV.                High profile attacks

• Zeus [3]:Initially operated as a banker Trojan, targeted limited group of people, but over the years various Zeus botnets are estimated to have affected millions of compromised computers. A hacker could build his own Trojan horse using the Zeus crimeware toolkit that allows a hacker to build his own Trojan horse. Came to limelight in 2007, the Trojans based on Zeus was still considered the most dangerous  in the world, utilizing form grabbing, keylogging and polymorphic variants of the Trojan that use drive-by downloads to capture users data.
• Zero Access Rootkit [4]:Millions of systems were infected by the botnet spread and the number is rising till date.

• Adwind [4]:These are configured using Java which is dispersed as a solitary malware-as-a-service. They can be utilized to remotely control tainted PC’s; to acquire documents, key strokes and stored passwords. It can also record audio and video through the computer’s webcam and microphone. Plug-ins can also be used to enhance its functionality.
• AlienSpy RAT [4]:has assaulted nearly 400,000 corporate and private targets in the finance, social body, education and engineering sectors around the world according to reports and have been instructed to remain aware. Also referred to as AlienSpy, Frutas, Unrecom, Sockrat, JSocket and jRat. The RAT is sent as a payload to individual machines by phishing. If target  opens an email document stacked with a pernicious AlienSpy JAR file, the malware introduces itself on the PC and endeavors to communicate with the operator’s command and control (C&C) server for additional instructions.
• Bitfrost [1]:remote access Trojan (RAT) that contaminated Windows customers by changing, making and modifying segments.
• Tiny Banker [1]:allowed attackers to steal sensitive financial information. Specialists in the Center for Strategic and International Studies Security Group distinguished ‘Tinba’ in 2012 after two dozen noteworthy U.S. banks were tainted.
• FakeAV Trojan [1]:embedded itself in the Windows framework tray and persistently displayed an official-looking pop-up window, cautioning the client to a problem with the computer. In the process of resolving the issue ,clients were tricked into downloading more malware.
• Magic Lantern [1]: Trojan developed by the FBI, which is based on keystroke logging to facilitate with criminal monitoring activities.

                         V.       Defense mechanism

To increase your odds of not encountering a Trojan, follow these guidelines

• Remain diligent [2]:Computers can be infected by trojans via websites, attachments in emails and instant messaging applications. Only when we are sure of the source the files should be downloaded.

• Ensure operating system is up to date [2]:It is very important if one is using a Windows operating system.

         Install reliable anti-virus software [2]:It is essential one downloads any updates regularly to filter different types of trojans , viruses, and worms. Care should be taken to ensure that the e-mails and files which are downloaded are examined thoroughly.

• Consider installing a firewall [2]:.A firewall can restrict unauthorized access to a system. When it is used along with a updated operating system and an efficient anti-virus software greatly helps to prevent infection.

V.                  Conclusion

This paper presents the description of trojan in detail. It also consists of different types of trojan, detection and preventive measures that can be taken to protect an organization or an individual user against trojan attack. It recommended not to open unless one is certain of its authenticity. This concerns particularly to e-mail documents that contain .exe files. Even if one is aware sure the attachment is authentic, it is still recommended to run it through your virus scan program (with the latest virus definitions) as a precaution. One should keep in mind of how things ended for the people of Troy- Never let a trojan find a way into your devices.

References

[1]      Kaspersky lab,”What is a Trojan Virus”,2018.[Online].Available:

https://www.kaspersky.com/resource-center/threats/trojans

[2]      P.Arntz,”What are Trojans?”,2013.[Online].Available:

https://www.blog.malwarebytes.com/cybercrime/2013/06/What-are-trojans.htm [Accessed on Oct.19,2018]

[3]      PCsecurityworld,”Trojan Horse Malware Detection”,2018.[Online].Available:

https://www.pcsecurityworld.com/83/trojan-horse-malware-detection-prevention.html [Accessed on Oct 15,2018]

[4]      SearchSecurity”Trojan Horse computing”,2017.[Online].Available:

https://searchsecurity.techtarget.com/definition/Trojan-horse

[5]   M86BankTrojan.(2010).[online]Available:

        http://i.i.cbsi.com/cnwk.1d/i/tim/2018/08/10/M86BANKTROJAN.png [Accessed on 20 Oct.2018]