Using CFW to Defend Against Trojans

Application Scenarios

Trojans are a type of common network attacks. Trojans are implanted in computers to control the computers, steal user information, and damage computer systems. Trojans are highly disguised and latent, making them difficult to detect and remove.

CFW provides intrusion prevention rules for Trojans, helping you effectively identify and defend against Trojan intrusions.

What Is a Trojan?

Trojans are a type of malware program that invades a computer to implement illegal intents. Trojans usually disguise as legitimate software and induce users to download them. Attackers use Trojans to control users' computer systems and steal personal information, passwords, or other sensitive data, or damage the computer systems.

The difference between Trojans and computer viruses is that Trojans do not replicate themselves, are not infectious, and do not proactively initiate attacks. The main characteristics of Trojans are as follows:

• Disguised: Trojans usually disguise as programs or files that seem normal to deceive users into installing or opening them. There are many ways Trojans disguise themselves, for example, use a normal file icon, such as a text, image, or HTML icon; or to use the name of a system file.
• Hidden: Once a Trojan is implanted in a computer, it can lurk in the computer for a long time and is not easy to detect and remove, waiting for instructions from the attacker. Trojans are hidden in legitimate programs. When a Trojan is running, its icon is not displayed in the taskbar, and it cannot be easily detected by the task manager.
• Destructive: After a Trojan is implanted in a computer, attackers can remotely control the Trojan client to perform a series of illegal behaviors that can cause serious consequences, such as stealing user privacy information, controlling system running, and damaging system data.

Types of Trojans and Their Harms

Common Trojans and their harms include but are not limited to the following:

• Remote control: Remote control is a basic function of Trojans. Without the victim's knowledge, an attacker can deliver commands to remotely control the victim's computer and complete attack instructions, such as tampering with files and data and downloading malware.
• Password theft: This type of Trojan mainly collects all hidden passwords, such as the accounts and passwords of social accounts and online games, and sends out the password information without the victim's knowledge.
• Keylogger: This type of Trojans can record keystrokes, through which an attacker can obtain useful information such as passwords. This type of Trojan is automatically loaded when the OS is started. It can be online or offline, which records users' keystrokes in online or offline states, respectively. Generally, a keylogger Trojan can send recorded information to a controller via email.

How to Defend Against Trojans

The key to defending against Trojans is prevention, that is, blocking attacks before Trojans infect a device and cause losses. In addition to improving cybersecurity awareness, you can also use CFW intrusion prevention rules to defend against Trojans. The specific measures are as follows:

Improving cybersecurity awareness

• Install authorized OSs and applications. Do not download applications from non-official websites.
• Do not open emails or install software from unknown sources. Some seemingly normal emails and software may contain Trojans.
• Do not click pop-up advertisements on websites. Trojans often disguise as such advertisements.

Configuring Trojan prevention rules on CFW

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. In the navigation pane on the left, click and choose Security & Compliance > Cloud Firewall. The Dashboard page will be displayed.
4. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click View in the Operation column of a firewall to go to its details page.
5. In the navigation pane, choose Attack Defense > Intrusion Prevention. Click View Effective Rules under Basic Protection. The Basic Protection tab is displayed.
6. Filter the rules for defending against Trojans. In the filter above the list, select Trojan from the Attack Types drop-down list.
7. Enable protection in batches. Select multiple rules at a time and click Intercept.
   

   Intercept: The firewall records the traffic that matches the current rule in attack event logs and blocks the traffic.