1
00:00:00,090 --> 00:00:00,990
In this lesson,

2
00:00:00,990 --> 00:00:03,000
we're going to take a look at Trojans.

3
00:00:03,000 --> 00:00:04,920
Now, before we dive into this piece of malware,

4
00:00:04,920 --> 00:00:06,540
let's look at history for a moment

5
00:00:06,540 --> 00:00:08,820
and learn what a Trojan actually is.

6
00:00:08,820 --> 00:00:10,350
Now, a couple of thousand years ago

7
00:00:10,350 --> 00:00:12,660
Greece and the city of Troy were at war.

8
00:00:12,660 --> 00:00:15,690
This lasted for about 10 years with no end in sight.

9
00:00:15,690 --> 00:00:18,450
After a long siege, the Greeks started getting restless

10
00:00:18,450 --> 00:00:20,490
and they decided they were going to try something different.

11
00:00:20,490 --> 00:00:23,580
So they went out and constructed a large wooden horse

12
00:00:23,580 --> 00:00:25,470
that they decided to give to the city of Troy

13
00:00:25,470 --> 00:00:27,000
as a peace offering.

14
00:00:27,000 --> 00:00:28,950
Now, unfortunately, for the citizens of Troy,

15
00:00:28,950 --> 00:00:31,260
this seemingly harmless gift was actually filled

16
00:00:31,260 --> 00:00:32,280
with Greek soldiers,

17
00:00:32,280 --> 00:00:34,530
and once it was wheeled safely into the city,

18
00:00:34,530 --> 00:00:35,520
the day turned to night

19
00:00:35,520 --> 00:00:38,430
and the soldiers came out from within that Trojan horse.

20
00:00:38,430 --> 00:00:40,170
This handful of soldiers then went over

21
00:00:40,170 --> 00:00:42,900
to the walled city's gates, unlocked them and opened them,

22
00:00:42,900 --> 00:00:45,900
and let the rest of the invading Greek army into the city

23
00:00:45,900 --> 00:00:48,990
which rapidly laid waste to the entire city of Troy.

24
00:00:48,990 --> 00:00:50,850
Now, this is where the term Trojan horse,

25
00:00:50,850 --> 00:00:54,450
or as we call it in cybersecurity, a Trojan, gets its name.

26
00:00:54,450 --> 00:00:55,650
Now, in cybersecurity

27
00:00:55,650 --> 00:00:57,810
Trojans work quite similarly to the gift horse

28
00:00:57,810 --> 00:01:00,360
delivered by the Greeks to the city of Troy.

29
00:01:00,360 --> 00:01:02,483
Now, a Trojan is simply a piece of malicious software

30
00:01:02,483 --> 00:01:04,860
that is disguised as a piece of harmless

31
00:01:04,860 --> 00:01:06,600
or desirable software.

32
00:01:06,600 --> 00:01:08,670
Basically, a Trojan claims it's going to perform

33
00:01:08,670 --> 00:01:10,980
some kind of needed or desired function for you

34
00:01:10,980 --> 00:01:13,440
and that Trojan will indeed perform that function,

35
00:01:13,440 --> 00:01:15,780
but it also performs a malicious one

36
00:01:15,780 --> 00:01:17,490
like installing a backdoor or virus

37
00:01:17,490 --> 00:01:19,200
onto your system as well.

38
00:01:19,200 --> 00:01:21,240
Now, when I was a kid back in the 1980s

39
00:01:21,240 --> 00:01:23,760
there was this great new game that came out called Tetris

40
00:01:23,760 --> 00:01:25,200
and everybody loved it.

41
00:01:25,200 --> 00:01:28,350
Now, Tetris was, and still is, an extremely popular game

42
00:01:28,350 --> 00:01:30,960
and everybody wanted to get a copy of it back in those days.

43
00:01:30,960 --> 00:01:32,130
But back then,

44
00:01:32,130 --> 00:01:34,680
we really didn't have the internet to download games,

45
00:01:34,680 --> 00:01:36,840
and so instead, you may have received a floppy disk

46
00:01:36,840 --> 00:01:39,810
from your friend at school who had a copy of the game.

47
00:01:39,810 --> 00:01:42,390
Now, this became a common practice, and back in those days,

48
00:01:42,390 --> 00:01:44,400
people really weren't thinking about computer viruses

49
00:01:44,400 --> 00:01:45,810
the way we do today.

50
00:01:45,810 --> 00:01:47,850
Well, an attacker got this great idea

51
00:01:47,850 --> 00:01:49,230
of embedding some malicious code

52
00:01:49,230 --> 00:01:51,600
into the Tetris game and then passing out disks

53
00:01:51,600 --> 00:01:54,690
with that infected version to lots of different people.

54
00:01:54,690 --> 00:01:56,190
If you received one of those disks,

55
00:01:56,190 --> 00:01:58,620
you might put it in your computer in order to run the game,

56
00:01:58,620 --> 00:01:59,670
And when you did that,

57
00:01:59,670 --> 00:02:02,100
the game would actually play just like you thought it would,

58
00:02:02,100 --> 00:02:03,480
but what was actually happening

59
00:02:03,480 --> 00:02:05,610
behind the scenes was it opened a connection

60
00:02:05,610 --> 00:02:07,710
between your system and their system

61
00:02:07,710 --> 00:02:09,539
so the attacker could gain remote access

62
00:02:09,539 --> 00:02:11,520
and control over your system.

63
00:02:11,520 --> 00:02:14,160
Now, what I just described is one of the earliest examples

64
00:02:14,160 --> 00:02:18,150
of what we now refer to as a RAT, a Remote Access Trojan.

65
00:02:18,150 --> 00:02:19,620
Now, a RAT is a type of Trojan

66
00:02:19,620 --> 00:02:21,480
that's widely used by modern attackers

67
00:02:21,480 --> 00:02:23,460
because it provides the attacker with remote control

68
00:02:23,460 --> 00:02:25,170
of a victimized machine.

69
00:02:25,170 --> 00:02:27,210
Now, let's go back to that Tetris example,

70
00:02:27,210 --> 00:02:29,310
because young Jason found this to be a great way

71
00:02:29,310 --> 00:02:31,350
to mess around with his online friends.

72
00:02:31,350 --> 00:02:32,820
So I could go out and give a copy

73
00:02:32,820 --> 00:02:35,400
of this infected version of Tetris over to my friends,

74
00:02:35,400 --> 00:02:36,870
and when they started playing it,

75
00:02:36,870 --> 00:02:39,000
a remote connection would be created from their machine

76
00:02:39,000 --> 00:02:40,530
back to my machine.

77
00:02:40,530 --> 00:02:42,090
Now, once that connection was established

78
00:02:42,090 --> 00:02:44,730
I could do all sorts of things that I thought were hilarious

79
00:02:44,730 --> 00:02:46,890
on my friend's system, like logging in as them

80
00:02:46,890 --> 00:02:49,560
on their computer, opening and closing their CD drive,

81
00:02:49,560 --> 00:02:51,450
playing music or alerts on their computer,

82
00:02:51,450 --> 00:02:52,710
flipping their screen upside down

83
00:02:52,710 --> 00:02:55,200
so that everything appeared backwards or upside down,

84
00:02:55,200 --> 00:02:57,240
and all sorts of other weird things like that,

85
00:02:57,240 --> 00:02:59,790
all while maintaining remote access and remote control

86
00:02:59,790 --> 00:03:02,640
of my friends' computers by using this Trojan.

87
00:03:02,640 --> 00:03:04,590
Now, in my case, this was being done for fun

88
00:03:04,590 --> 00:03:06,930
against my friend's computers or later on in life,

89
00:03:06,930 --> 00:03:08,610
as part of my network penetration test

90
00:03:08,610 --> 00:03:10,680
that I was involved with over the years.

91
00:03:10,680 --> 00:03:12,750
So remember, when you're dealing with a Trojan

92
00:03:12,750 --> 00:03:14,640
you're dealing with a piece of malicious software

93
00:03:14,640 --> 00:03:16,380
that's disguised as a piece of harmless

94
00:03:16,380 --> 00:03:18,000
or desirable software.

95
00:03:18,000 --> 00:03:19,770
Trojans are commonly used by attackers

96
00:03:19,770 --> 00:03:22,020
to exploit a vulnerability in your workstation

97
00:03:22,020 --> 00:03:23,820
and then conduct data exfiltration

98
00:03:23,820 --> 00:03:26,340
to steal your sensitive documents and create back doors

99
00:03:26,340 --> 00:03:27,870
to create persistence in your system

100
00:03:27,870 --> 00:03:29,880
and other malicious activities like that.

101
00:03:29,880 --> 00:03:32,310
So, anytime you download a program from the internet,

102
00:03:32,310 --> 00:03:34,680
you always need to be careful to check them for Trojans

103
00:03:34,680 --> 00:03:37,530
by using a good anti-virus or anti-malware solution

104
00:03:37,530 --> 00:03:40,320
prior to opening or installing any programs you download,

105
00:03:40,320 --> 00:03:42,030
as well as making sure your systems are patched

106
00:03:42,030 --> 00:03:43,320
against known vulnerabilities

107
00:03:43,320 --> 00:03:44,580
in order to prevent your system

108
00:03:44,580 --> 00:03:47,583
from falling victim to the attacks created by Trojans.