Trojan horse programs are called after one of the most famous deceptions in history. In ancient Troy, the Greek army appeared to leave the war ravaged shores of Troy, but left a large wooden horse in what showed to be a peace gift. Within the Trojan horse lay an elite group of Greek warriors, unbeknownst to the City of Troy. Once inside the City, the elite warriors quickly and efficiently performed their planned operation and captured the City.
Software Trojans masquerade as an application or file that entice a user to open it. A Trojan horse may copy itself on to the compromised computer, but it doesn't make copies of itself and spread like a virus which is a key difference between a Trojan and a virus. While most Trojans only execute their own malicious code, some Trojans may actually perform the actions of the file they pretend to be, but then they execute their own malicious code on the compromised computer. Other Trojans make it appear that they are performing the desired actions, but in reality do nothing but trigger their malicious routines.
Trojans arrive on to compromised computers in a variety of ways. These methods distribute the Trojan, often
as rapidly as possible, so that the Trojan can maximize the opportunity to perform its main function in a large user population before
they are detected by antivirus software.
One of the most common methods is for the Trojan to be spammed as an email attachment or a link in an email. Another similar method has the Trojan arriving as a file or link in an instant messaging client. These methods often rely on social engineering techniques to tempt the user to click on the link or open the file since many of these emails and instant messages appear to come from people the user knows. These techniques will play on a user's curiosity about the big new item such as a celebrity scandal, crisis, catastrophe, or major global event.
Another means of arrival includes a method called drive-by downloads. A drive-by download occurs when a user goes to a web site that is either legitimate, but compromised and exploited or malicious by design. The download occurs
surreptitiously without the user's knowledge. Alternatively, the user is asked to update or add a video codec when at a malicious web site. When the user complies with this request, they inadvertently download a Trojan pretending to be the video codec.
The late but not least, a Trojan horse program can be dropped or downloaded by other malicious software or by legitimate programs that have been compromised or exploited on the compromised computer.
Just as each Greek warrior had his own task to perform in capturing Troy, there are several types of Trojans, each with particular functions. Some Trojans perform multiple functions and have the prefix of Trojan, while others are categorized by their main functions.