A favorite way to compromise computer networks among less skilled hackers today is the use of trojan horse programs.
Trojan horse applications get there name from the ancient Greek siege of Troy. The Greeks tried for many years to get inside the walled city with little success. Finally the Greeks decided to use one more trick to capture Troy. They built the trojan horse. The Greeks would hide a hand full of men inside the horse, who would then open the city gates To the Trojans, the horse appeared to be an offering to the gods for forgiveness. The Trojans brought the horse inside of city of Troy as a war trophy and began to celebrate their great victory over Greece.
When night fell on Troy, the wooden horse opened up and Greek soldiers that had hidden inside of the horse opened the main gate and the waiting Greek army burned the city Troy to the ground.
So, the same is true with trojan horse programs. The trojan is designed to appear innocent in nature such as a picture, email, webpage etc. Trojans can be enbedded in almost anything that we find on networks or the internet today.
When a hacker gets a trojan on your machine, they can monitor almost anything you can think of. They can log everything you type on your keyboard, they can install apps remotely and view documents, log into servers or mainframes on your network and surf the web. Really anything you can do on your computer, the hacker can also do. Kinda scarey if you think about it. This one application can allow the hacker to bypass all of the wonderful perimiter defense systems that companies spend so much money on today (firewalls, proxy servers and IDS/IPS systems).
So, in this article we discover that the would be hacker is not the only one who can get access to your system. It appears that one of the top trojans used today (Backdoor.OptixPro.12) has a backdoor password that was built into it by the programmer (Sleaze). This would allow Sleaze to also log into your machine and use it for what ever reason he see's fit. The funny thing is that not even the original hacker who compromised the victim system would know about the system access. I doubt this will slow down the hacker underground from using this application, but to quote Rickie Ricardo from I love Lucy "Sleaze...You got some exlaining to do!"
The author of a free Trojan horse program favored by amateur computer intruders found himself with some explaining to do to the underground last month, after his users discovered he'd slipped a secret backdoor password into his popular malware, potentially allowing him to re-hack compromised hosts.
The program in question is Optix Pro (Backdoor.OptixPro.12), a full-featured backdoor that allows an intruder to easily control a compromised Windows machine remotely, from accessing or changing files, to capturing a user's keystrokes or spying on a victim through their webcam. Though some features could make Optix Pro usable as a legitimate remote management tool, others are clearly tailored to the underground, including a function that disables a machine's anti-virus and firewall software. The program has been downloaded nearly 270,000 times, according to a counter on the distribution site.
Like other species in a genus that includes BO2K, SubSeven, and Beast, the working end of Optix Pro is a server that the hacker must insinuate into a victim's computer, either through subterfuge - by misrepresenting it as an image file or an electronic greeting card - or by uploading it to an already-compromised machine. The hacker sets a password on the Optix Pro server, so that no other would-be intruders have the ability to slip through the open backdoor.
That is, none except for the author, a coder named "Sleaze" (he spells it "s13az3"), who secretly embedded in the program a random-looking 38-character "master password" that was known only to him.
Though the password was encrypted in the binary, at some point suspicious hackers teased the cleartext version from RAM, and it began circulating quietly in the underground, possibly as early as last year. Last month it surfaced on a hacker website, forcing Sleaze into an embarrassing admission. "I have never talked about master passwords before because I thought it best not to do so until one was ever found," Sleaze wrote, in a front page posting to the Optix Pro distribution site. "However, now I feel the time is right to confirm there is [one]."
In his defense, Sleaze noted, "I have never directly denied the existence of a master pass." He added that he never used the backdoor-within-a-backdoor to take over machines properly owned up by his users. He only included it for his own security.
If the FBI ever got too close to Sleaze he had intended to release the secret password to the world, causing Optix Pro to become less popular among intruders and easing the pressure from law enforcement. "That's when a master pass could potentially save a programmer," he wrote.
Merely writing a backdoor program is not illegal under US federal law, but arrests have been made in other countries, most recently Germany and Taiwan.
Rival hackware coder and self-described grey hat hacker "illwill," himself no stranger to security company threat profiles, says untrustworthy code has beset the underground for years: the popular SubSeven backdoor also included a secret password, he said, as does the more obscure Infector. "It's kind of a big deal to the kiddies," he wrote in an IM interview. "The authors see it as a way to control what they create, or let their 'krew' get in on the victims that other people get."
In a disclaimer evocative of advisories from more mainstream software vendors, Sleaze pointed out in his posting that the backdoor password in circulation only works on an older, unsupported versions of the Trojan horse, and that the latest version of Optix Pro uses stronger encryption to protect a different master password. "So make sure you update!," he wrote.
At least one security expert says there's a lesson to be learned from the whole affair. "It obviously says you should always use open-source Trojans," says Mark Loveless, a senior security analyst with Bindview Corporation. "That's the moral. You can't even trust Windows malware."
