Trojans, which are increasingly being used to steal credit card data and passwords, or to launch attacks against organisations, are not picked up adequately by basic security software such as an anti-virus engine, states a white paper issued by global security and messaging company GFI.
The paper describes the seven main types of Trojan and explains how a Trojan can infect a network via an e-mail attachment or downloaded file.
It explains that most virus scanners detect some known Trojans, but they are unable to scan unknown ones. This is because anti-virus software relies mainly on recognising the "signatures" of each Trojan. Because the source code of many Trojans is easily available, a more advanced hacker can create a new version of a Trojan, the signature of which is unknown to any anti-virus scanner.
"If the person planning to attack you finds out what anti-virus software you use, for example through the automatic disclaimer added to outgoing e-mails by some anti-virus engines, he will then create a Trojan specifically to bypass your virus scanner engine," the paper points out.
"Also, apart from failing to detect unknown Trojans, virus scanners do not detect all known Trojans either - most virus vendors do not actively seek new Trojans, and research has shown that virus engines each detect a particular set of Trojans."
How to protect networks
The white paper proposes that to detect Trojans, companies should use a multi-level strategy and deploy multiple virus scanners at the gateway, which would increase the percentage of known Trojans caught; and use content security with executable analysis to detect potentially malicious executables, analyse what they might do and prevent unknown Trojans from entering the network.
Detecting unknown Trojans can be done by manually reviewing each incoming executable; yet this is a time-intensive job, and can be subject to human error. Therefore it is better to automate the process by means of a Trojan-and-executable scanner that can intelligently analyse what each executable does and how dangerous it is.
Such scanners disassemble the executable and detect in real-time what it might do. It compares these actions to a database of malicious actions and then rates the risk level of the executable.
Share
