[Full-disclosure] Re: Help put a stop to incompetent computer forensics

[Jason Coombs]

James Tucker wrote:
> Sorry, how many programs which you class as "Trojans" add what you
> define as a "backdoor", given that a "backdoor" is generally
> pre-compiled code which allows access via previously un-announced or
> commonly unused connection methods? Malware doesn't typically ADD
> backdoors, it comes shipped with them, thus the classification
> Trojan.Backdoor, as opposed to just Trojan. Many of the more common
> Trojans these days are Worms, Trojans, and Backdoors and some are Viri
> too. The reason is simple - short of breaking the kernel process
> scheduler it is useful to be a Trojan when present as an active virus.
> Similarly due to the current nature of desktop and server side
> application logic, most viri are unsuccessful without being worms -
> although this may change in a few decades as applications become more
> data driven and automatic. Nothing will ever substitute a full
> description of a particular malware's actions in describing what it
> does, unless you expect malware authors to start conforming to
> standards.


Applying the broader definition of Trojan, I can't even make sense out 
of your paragraph above. But I know that you aren't using the term to 
communicate the idea of malware that enables the attacker to gain 
control over, and future access to, the infected system ... If that's 
the definition you had in mind, then the paragraph you wrote makes 
logical sense. Otherwise, not.

I agree that calling it a backdoor isn't comfortable, it just doesn't 
fit. This is part of why I'm saying that the definition of Trojan must 
include the access and control that a backdoor gives.

It doesn't make sense to me that "Many of the more common Trojans these 
days are Worms, Trojans, and Backdoors ..." unless you are using Trojan 
to communicate the feature of remote access to the infected box.

Sincerely,

Jason Coombs
jasonc at science.org