  We analyzed the security of the secure direct communication protocol based on
secret transmitting order of particles recently proposed by Zhu, Xia, Fan, and
Zhang [Phys. Rev. A 73, 022338 (2006)], and found that this scheme is insecure
if an eavesdropper, say Eve, wants to steal the secret message with Trojan
horse attack strategies. The vital loophole in this scheme is that the two
authorized users check the security of their quantum channel only once. Eve can
insert another spy photon, an invisible photon or a delay one in each photon
which the sender Alice sends to the receiver Bob, and capture the spy photon
when it returns from Bob to Alice. After the authorized users check the
security, Eve can obtain the secret message according to the information about
the transmitting order published by Bob. Finally, we present a possible
improvement of this protocol.
