The Trojan horse is to blame

Security Focus

Translation by Tatyana Danilova

The Greek myth reads: the seer Laokon, the priest of Apollo, warned the inhabitants of Troy so that they would not let the huge wooden horse into the city, which Odysseus came up with and made Master Epei. "Trojans, do not believe the horse! Whatever it is, be afraid of the Greeks, even the gifts of bringing!" - Like 4000 years ago, this famous prophecy is relevant today - in relation to downloading unknown files.

It is believed that we know everything about the dangers of the Trojan horse. But you should consider new insidious legal quails. Over the past few months, the British court justified several people. They were justified on the basis of the "Trojan Protection", which we, lawyers in criminal cases, call "the protection of the ESCD - did someone else."

Trojan defense is fraught with two equally dangerous problems: the possibility of justifying the guilty or condemnation of an innocent.

In the first case, given the nature of electronic evidence, virtually the entire investigation of a computer crime is relied on for accurate evidence. To prove that John Dow hacked, for example, the company ABC, you need to collect ip logs and much more; It is possible to get stored with this very John DOW in IRC, to knock out a warrant or agenda to the court to receive information from his provider, to present actions that could be related to hacking. Only then you will receive a warrant that gives the right to knock on the door of John Dow and remove his computer - provided that you are an agent of law enforcement agencies. If during the forensic examination of the computer, files indicate that the machine was used when accessing hacked sites, email messages of the corresponding content and even codes used for malicious actions, then consider that the ball in the basket and the guilty is convicted. Right?

Non -bonds in the United Kingdom

But what if, in addition to all this, you found Trojan in the computer - say, one of the Optix Pro versions or another program for remote access? Does the presence of such a program mean automatically withdrawing charges from the suspect? Probably not. However, given the ephemeral nature of electronic evidence and the fact that they can always be changed, how much you, you personally, are sure of the guilt of John DOW, even if there are no grounds for doubt? After all, the higher the qualifications of the hacker, the more attractive the goal will be he (or she) for other hackers. Finally, being a hacker, will you store the files that are convicting you in your car? Or, nevertheless, throw them on someone else's computer, how does the cuckoo throw your eggs into other people's nests? Hackers have been using such “parking” strategies for their files for many years.

Julian Green was arrested in October 2002 after the police found children's pornography during a search of his home computer. The provider preserved the logs that indicate that Green downloaded certain files, and the presence of children's porn on his computer seemed to confirm the accusation and left no doubt that he would be convicted.

However, the defense expert found evidence that Trojan was planted on the computer of Green, developed to intercept the control of the browser and redirect him to porn sites. Most likely, Trojan got into the computer from a file attached to the email post - and such an assumption sounded more believable that Green had a son of 13 years old. Not being able to prove that Green deliberately and deliberately downloaded child pornography, the court rejected the charge.

The same thing happened with the 19-year-old hacker Aaron Kuffrey, accused of the Soutord court of organizing the DDOS attack on the computers of the Houston Port (Texas) in September 2001, less than two weeks after the events of September 11. The port server was disconnected, and the analysis of the logs showed that the source of the attack was the Kuffry computer.

Unlike the case of Green, the forensic examination of the computer did not find traces of Trojan programs. At the hearing in the court, Kuffry simply pointed out the possibility of organizing an attack through the Trojan program and that his case refers to when there is reason for doubt. The jury agreed with this, and in October 2003, Kuffry was justified.

Trojan blackmail

In the second half of December 2003, companies around the world reported a new form of cyber attacks, which continued, obviously, about a year. Cyber ​​-carriers (as reported, from Eastern Europe) threatened to “plant” children's porn in corporate computers and then inform the police if they were not paid. If the blackmail did not agree to pay $ 30 of the "compensation", the hacker stated that he would be erase the contents of the hard drive or put children's pornography there. The probability of the presence of Trojans and the ease with which they can be used made these threats very believable.

Two of the above British judicial cases illustrate the problem of the Trojan Protection: it not only complicates the use of electronic evidence for the final evidence of guilt, but also to a certain extent simplifies the manufacture and installation of electronic certificates that do not contradict the prosecution. In fact, owning some skills and tools, you can not only slip this kind of evidence, but also do this without leaving virtual traces, so that it will become impossible to establish the innocence of your “goal”.

In the Trojan, planted to attack someone else's computer or to download reprehensible files, there may be the possibility of self -destruction with subsequent removal from the hard disk of all traces of its existence. And it will become almost impossible to prove your innocence, rejecting obvious evidence. The emergence of real cyber absorption and cyberlovushki is just a matter of time - unless they exist in reality - especially now that sentences for computer crimes are simply dragon.

Of course, reliable information security methods will help in all this. The prevention of the penetration of the Trojans, the search for malicious code, unusual activity and filtering spam - all this will help. They will help out both the viewing and analysis of the logs. And, of course, you can protect yourself from invasion by severity of authentication and access control. Here is another reason to do what computer security professionals repeat about for years.

As for the Laokon, his first expert conclusion about the danger of the Trojan horse and the warning to the Trojans violated the will of Poseidon, and the gods sent snakes, who killed both the expert and both of his sons. What proves loyalty to another axiom: not a single good deed remains unpunished.