Remote administration tool

Encyclopedia : R : RE : REM : Remote administration tool

---

A Remote administration tool is used to remotely connect and manage a single or multiple computers with a variety of tools, such as:

• Screen/camera capture or control
• File management (download/upload/execute/etc.)
• Shell control (usually piped from command prompt)
• Computer control (power off/on/log off)
• Registry management (query/add/delete/modify)
• Other product-specific function

Direct Connection

A direct-connect RAT is a simple setup where the client connects to a single or multiple servers directly. Stable servers are multi-threaded, allowing for multiple clients to be connected, along with increased reliability. A diagram below is shown to better illustrate the concept (func = function):

    [CLIENT]
|    [CLIENT]
|      /
|     /
|    /
|   /
[SERVER]-----[CLIENT]
/  |   \
Func Func Func

Reverse Connection

Reverse connection RATs are a new technology that came around about the same time that routers became popular. A few advantages of a reverse-connection RAT are listed below:

• No problems with routers blocking incoming data, because the connection is started outgoing for a server
• Allows for mass-updating of servers by broadcasting commands, because many servers can easily connect to a single client.

A diagram is shown below (note, it is basically the reverse of direct connection-type RATs:

Func   Func
\    /    Func    Func
[SERVER]   \    /
|    [SERVER]
|      /
|     /
|    /   Func    Func
|   /      \     /
[CLIENT]-----[SERVER]

RAT Trojan Horses

Many trojans and backdoors now have remote administration capabilities allowing an individual to control the victim's computer. Many times a file called the server must be opened on the victim's computer before the trojan can have access to it. These are generally sent through email, P2P file sharing software, and in internet downloads. They are usually disguised as a legitimate program or file. Many server files will display a fake error message when opened, to make it seem like it didn't open. Some will also kill antivirus and firewall software. RAT trojans can generally do the following:

• Download, upload, delete, and rename files
• Format drives
• Open CD-ROM tray
• Drop viruses and worms
• Log keystrokes
• Hack passwords, credit card no.
• Hijack homepage
• View screen
• View, kill, and start tasks in task manager
• Hide desktop icons, taskbar and files
• Print text
• Play sounds
• Randomly move and click mouse

Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on April Fool's day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or hack. They usually do wimsical things like flip the screen upside-down, open the CD-ROM tray, and swap mouse buttons.

Popular RAT trojans

• SubSeven
• ProRat
• NetBus
• AutoSpY

Popular RAT pranks

• [ErrMess Remote Computer]
• [Office Poltergeist]

See also

• [ChaseNET] — Popular discussion board for remote administration tools and computer security issues.
• [Government Security] — Network security articles and hacking prevention resources for the government and general public.
• [Wilders Security Forums] — Large discussion forums regarding remote administration tools and other aspects of computer security. Official discussion forums of many security products such as NOD32, Ewido and Ghost Security's RegDefend.

• Trojan horse
• VNC

 

---

From Wikipedia, the Free Encyclopedia. Original article here. Support Wikipedia by contributing or donating.
All text is available under the terms of the GNU Free Documentation License See Wikipedia Copyrights for details.

Search Titles

0

1

2

3

4

5

6

7

8

9

A

B

C

D

E

F

G

H

I

J

K

L

M

N

O

P

Q

R

S

T

U

V

W

X

Y

Z

?