Trojan Horses

Because of the NT file system's tight access control, Trojan horse attacks have generally been unsuccessful. Trojan horse attacks attempt to deceive users with phony login dialog boxes that can capture account and password information on behalf of an intruder. As we explained earlier, NT's primary form of defense against this kind of Trojan horse attack is the so-called Trusted Path. The operating system captures the unique key sequence Control-Alt-Delete ahead of anyone else and presents a legitimate login screen. Intruder-supplied Trojan horse programs can't activate in place of the authentic login screen. However, the Trojan horse problem does arise if the intruder can cause a user's workstation to boot up DOS instead of NT. In such cases, it's possible for a Trojan horse program to simulate NT's login appearance and capture the user's account name and password. As we explained above, the best overall defense against such contingencies is to maintain an all-NT environment, precluding user workstations from using any other OS.