1

According to this article on Wikipedia, a trojan horse can allow a remote connection by opening a random port if it is able to bypass the firewall. I'm not much of an expert of routers and Network Address Translation but if a trojan horse opens a connection through the firewall, how does this allow the owner of the trojan who is on another network to connect to the victim computer since the victim computer IP is private and can't be connected to.

Example scenario A trojan horse opens a random port 1234 on the victim computer when ran and assume that it bypasses firewall. How is the attacker able to connect to the victim computer remotely.

Victim computer has private IP 192.168.1.147 and public IP 10.1.1.44 and attacker has private IP 192.168.0.119 and public IP 10.2.1.54, how do the two computers communicate with each other?

Assuming that victim computer has a listener on port 1234 and attacker has connector that connects to port 1234 and takes IP of victim. What IP would the attacker use? Would it be the public IP or the private IP?

8

The attacker doesn't connect to the victim computer, the victim computer connects to the attacker. Data in a connection can flow in both directions, it doesn't matter who initiates the connection in the first place. Once a connection is established the attacker is able to execute commands on the victim computer. The attackers use well-known web protocols that are usually allowed.

Here's how it works:

  • The attacker compromises a server of servers to set up a command and control (C&C) system
  • The trojan is customized to connect to the C&C systems
  • The trojan is distributed (by spam emails, drive by downloads,etc) and victim systems infected
  • The infected systems initiate connections to the C&C systems
  • The attacker sends commands, updates, etc to the victims through the victim connection
  • The victim computers then action the malware commands (send spam, scan for identity or credit card information, search for company secrets, etc)
  • The victim computers send reports and data back to the attacker
0

A trojan opening a server port is one, but not the only way to allow a remote attacker access.

Another method is to have the trojan initiate the connection itself. When active, the trojan will open a connection to a command-and-control server under the control of the attacker, submit information to identify itself and the machine it is running on, and ask for commands to execute. A router will usually not block an outbound connection, so it won't prevent this.

  • i'm still confused, is the 'command-and-control' server a website of some sort written in PHP or is it a remote computer of the attacker, sorry for my lack of knowledge on this topic. – David Sep 11 '14 at 9:26
  • @David It can be either. There are many kinds of trojans or malware with trojan-like behavior and they all work different. Using a webserver is a quite inconspicuous way, because HTTP traffic is very common and thus hard to recognize as malicious by IDS systems. But it's not the only way. – Philipp Sep 11 '14 at 9:27
  • and the command-and-control server that you mention, please explain more on that. :) – David Sep 11 '14 at 9:31
  • @David What do you want to know? – Philipp Sep 11 '14 at 9:32
  • what exactly a c&c server is and how it operates and what language it's written in? – David Sep 11 '14 at 9:33
0

Victim computer has private IP 192.168.1.147 and public IP 10.1.1.44 and attacker has private IP 192.168.0.119 and public IP 10.2.1.54, how do the two computers communicate with each other?

Assuming that victim computer has a listener on port 1234 and attacker has connector that connects to port 1234 and takes IP of victim. What IP would the attacker use? Would it be the public IP or the private IP?

This is accomplished through Network Address Translation, aka NAT.

Your router keeps track of which IPs are communicating on which ports and translates accordingly.

The attacker will connect to your public IP which your router will then in turn "map" or NAT to your internal IP on the correct port.

The following will help explain NAT in more detail: https://www.youtube.com/watch?v=QBqPzHEDzvo

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.