What is the main purpose of a Trojan horse in network and information security?
- (a)To steal or delete files and create a backdoor for hackers
- (b)To intercept network traffic by flooding communication channels
- (c)To block network traffic by overwhelming servers
- (d)To silently copy itself to other systems using network vulnerabilities
Answer
Why
Correct — A. A Trojan horse is malware disguised as a harmless, useful program. Once run, it carries out its hidden job: stealing or deleting files, or installing a backdoor that listens for the attacker's commands.
That is option (a). Unlike a worm, a Trojan does not copy itself to other machines.
Why the others are wrong
- (b)To intercept network traffic by flooding communication channels — Flooding a channel is a denial-of-service technique: it swamps the link so legitimate traffic cannot get through. It intercepts nothing, and neither flooding nor interception is what defines a Trojan.
- (c)To block network traffic by overwhelming servers — Blocking traffic by overwhelming servers is denial of service, which NIST defines as the prevention of authorized access to resources. A Trojan is defined by its disguise, not by traffic it generates.
- (d)To silently copy itself to other systems using network vulnerabilities — Copying itself to other systems through network vulnerabilities is what a worm does. NIST describes a Trojan horse as nonreplicating: it does not copy itself onward.
Concept
NIST SP 800-83 defines a Trojan horse as "a self-contained, nonreplicating program that, while appearing to be benign, actually has a hidden malicious purpose." It adds that Trojans often deliver other attacker tools to a host, and backdoors head NIST's list of such tools.
The classic malware types differ in how they spread. A virus inserts copies of itself into programs or files. A worm propagates by itself across a network. A Trojan does not replicate at all and gets run because it looks harmless.
The same NIST guide (July 2013) notes that many, if not most, instances of malware are blended attacks mixing these traits. The question asks for the textbook purpose of a Trojan, and option (a) states it.
Key facts
- NIST SP 800-83 Rev. 1 calls a Trojan horse a self-contained, nonreplicating program with a hidden malicious purpose.
- A worm is a self-replicating, self-contained program that usually runs without user intervention (NIST SP 800-83 Rev. 1).
- A backdoor, in NIST's wording, is a malicious program that listens for commands on a TCP or UDP port.
- Denial of service is the prevention of authorized access to resources or the delaying of time-critical operations (CNSSI 4009).
Study next
Common traps
- Picking the self-copying description because Trojans end up on many machines, when a Trojan does not replicate.
- Treating any network attack, such as flooding, as the work of a Trojan.
This item names one malware type and fills the wrong options with the purposes of other attacks: flooding a channel, overwhelming servers, self-copying across a network. Match each description to its attack before answering.
Related PYQs
No directly related past PYQ was found.