端口反弹型木马通信技术研究及防范措施

Research on Communication Techniques for Port Recall Trojan Horse and Precautionary Measures

端口反弹型木马(Port Recall Trojan Horse)是一种新型的特洛伊木马(Trojan Horse),它不仅能够穿透防火墙,而且还可通过HTTP、SOCKS4/5代理,甚至还能访问局域网内部的没有公共IP的电脑,如用NAT透明代理和HTTP的GET型代理等的局域网,还可能入侵像拨号上网、ISDN、ADSL等的主机,给现有的计算机网络会带来了更大的危害。论文介绍了传统型特洛伊木马的通信原理和端口反弹型木马的通信技术,最后提出了对于端口反弹型木马的防范措施。

The Port Recall Trojan Horse （PRTH） is a new kind of Trojan Horse （TH）. It can not only pass through the firewall of LAN, but also intrude the intranet hosts without public network IP address. This kind of TH has caused the great harm to computer networks. In this paper, communication techniques between traditional TH and the PRTH are decribed, and the precautionary measures for the PRTH are proposed.