1
Faculty of
Computer and
Information
Sciences
Information Technology
Department
INFORMATION SECURITY
IT 311 T
Lecture 8: Malicious Software
(Cont.)
1 lecture contents:
Malicious Software
Trojan horses
Worms
Backdoors
Spammers
12 Oct 2025
Trojan Horse
4
A program that appears to have some useful purpose, but really masks
some hidden malicious functionality
Usually superficially attractive with hidden side-effects
** eg game, s/w upgrade etc
when run performs some additional tasks
allows attacker to indirectly gain access they do not have directly
Often used to propagate a virus/worm or install a backdoor or simply to
destroy data
12 Oct 2025
Trojans
5
Unlike viruses, Trojan horses do not replicate themselves .
Unlike viruses, which are just bad tricks, Trojan horses
usually attempt to do something useful for their creator
The main use of Trojans is to collect information from your
computer
This is why they are called spyware
12 Oct 2025
Trojans’ behaviour
6
Simple examples of typical behavior of a Trojan include:
Attempting to send e-mail messages to its creator.
Opening a TCP/IP port on your computer, to allow its
creator to connect to your computer.
12 Oct 2025
How Trojans collect
information
Keystroke trackers (also known as keystroke
recorders) – record what the user has typed
Fake login screens – they emulate login to find out
your password
Garbage trackers – they look in the RAM or on the
disk for documents which might be encrypted when
they are stored in files.
- 85% of documents edited yesterday can be found in
unused sectors of the hard drive
Protection against Trojans
Before your computer is infected:
* Do not download software from untrusted
sources
When your computer is infected:
* Checking logs
* Using sandboxes (what is a sandbox?)
* Using firewalls (what is a firewall?)
Worms
A worm is a self-replicating piece of code that
spreads via networks and usually doesn’t
require human interaction to propagate.
Example: Melissa virus from the previous
lecture could be also classified as a worm
Trapdoors/backdoors
A backdoor is a secret entry point to a program .
It allows attackers to bypass normal security
procedures, gaining access on the attacker’s own
terms.
a threat when left in production programs
allowing exploited by attackers
requires good s/w development & update
(this is the definition given with respect to one
separate program)
A programmer may sometimes install
a backdoor so that the program can be
accessed for troubleshooting and testing.
Backdoors (relative to one program)
Trapdoors/backdoors
A backdoor is a program that allows attackers to bypass
normal security controls on a system, gaining access on
the attacker’s own terms.
(this is the definition given with respect to the whole
computer system)
Backdoors (relative to a computer)
Backdoors
Remote execution of individual commands
Remote command-line access
Remote control of the GUI
Code in e-mail messages
These are simple techniques which an attacker can use.
It is possible to include executable code (e.g. JavaScript)
in e-mail messages.
This can be used to collect information about the receiver
of the message.
In more dangerous cases, the code can affect the work of
the receiver’s computer
Code in e-mail messages
Example: spammers check the validity of e-mail
addresses using HTML messages
<html>
<body>
<imgsrc=“[Link]/[Link]?id=3495">
</body>
</html>
How spammers check the validity of
17 e-mail addresses
The idea is as follows.
the spammer generates a numbered list of e-mail addresses,
for example:
1 aaa@[Link]
2 bbb@[Link]
…………
3495 asvern@[Link]
The spammer sends a message to each address, which
includes the number of this address in the list as an argument
of a script
12 Oct 2025
Code in e-mail messages
<img src=“[Link]/[Link]?id=3495">
Code in e-mail messages
19
Spammers can organize a denial-of-
service attack using images in messages.
Messages are sent to multiple addresses,
including a request of information from a
server.
<img src=“[Link]/[Link]">
12 Oct 2025
Code in e-mail messages
<img src=“[Link]/[Link]">
Chapter/ 21 malicious
software
Book :Cryptography and Network Security:
Principles and practice’, William Stallings Fifth
.edition, 2011
Lecture slides by Lawrie Brown for
“Cryptography and Network Security”, 5/e, by
William Stallings, Chapter 21 – “Malicious
THANK
YOU