Horse Trick

Malicious Trojan horse programs have been part of the IT landscape for decades. It is easier than you think to create an application with a secret purpose. We'll show you how.

- By Andrea Ciarrocchi

At the end of the legendary Trojan war, the Greeks left an offering for the people of Troy – a giant statue of a horse. Marveling at the gift, the Trojans brought the horse within their walls, not realizing it contained a lethal payload: Greek soldiers who would open the gates and let the Greek armies in to destroy the city. In other words, the Trojan horse was not what it appeared to be.

Figure 1: Installing Python tools in VS Code.

In today’s world, the term Trojan horse refers to a program that is not what it appears to be. A Trojan horse is a form of malware that appears to have a legitimate purpose but secretly performs some malicious function. Trojan horse programs are sometimes used to open a backdoor or harvest information for a remote attack. Some Trojan horse apps take the form of ordinary Linux utilities like ps or ls. Others might pass through links sent with email messages.

The increase in Linux’s popularity means malicious actors are also paying more attention, and the spread of harmful software will likely keep apace. Creating malware is often considered a dark art that only criminal hackers and spies truly understand, but the purpose of this article is to show just how easy it is to embed malicious code within an application. Of course, I will not provide any actual malicious code for this experiment. The sample code is just a placeholder for additional commands that an attacker could hide within the container application.

The project consists of two scripts in Python and a simple application in C++. The choice of Python arises from its portability, its ability to produce interpretable code or multi-platform executable packages, and its ease of use, which will allow me to achieve the desired result with just a handful of lines. The example listings are available for download [1].