Common Remote Access Trojan (RAT) tools -- which allow hackers to remotely control hijacked computers, from the cameras and mics to the hard-drive and keyboard -- are very badly written and it's easy to hijack computers running the "command and control" components that malicious hackers use to control RATted systems.
This weekend, Symantec senior threat researcher Waylon Grange will present a paper at the Blackhat conference in Las Vegas documenting his work exploring exploitable vulnerabilities in Gh0st Rat, PlugX, and XtremeRat.
The research raises thorny questions. For one, there's the ethical issue of whether and when it's OK to "hack back" against an adversary. Another is that these tools form the basis for many "lawful interception" tools sold by cyber-arms dealers to police and governments, and present a risk to their operators as well as their targets (recall that the Bavarian government's illegal "Bundestrojaner" spying tool could easily be hacked by third parties).
In many of the vulnerabilities Grange uncovered, a victim looking to hack back could exploit setup flaws in the attacker's RAT to access its command and control server (the computer the attacker uses to direct the RAT), download files from that attacker system, deposit code on it, or even create a persistent backdoor to sit on the attacker's system long-term. Hacking back has some standard possible objectives—retaliation perhaps, but also information-gathering as part of an attempt to discover an attacker's motives or identity. The exploits Grange developed could theoretically facilitate counterattacks that would allow victims to achieve these goals.
"If you got back on one of those machines and you sat there and listened you might be able to see who else they’re targeting or what type of groups they’re after or what type of information they’re after, which is very vital information when it comes to attribution," Grange says.
BUGS IN POPULAR HACKER TOOLS OPEN THE DOOR TO STRIKING BACK
[Lily Hay Newman/Wired]
(via Beyond the Beyond)
VPNFilter is a virulent, sophisticated, multistage worm that has successfully infected 500,000 home routers, leaving them vulnerable to both surveillance (the malware snoops network traffic for passwords) and region-wide internet shutdowns (VPNFilter can brick the routers it infects, and an attacker could shut down most or all of the home/small business internet access in a […]
VPNFilter is a sophisticated, multi-stage malware package, part of the new breed of boot-persistent malware (software that can survive a reboot); it targets home routers and network-attached storage devices, then steals passwords and logins that traverse the network and exfiltrates it to the creators' servers.
The White House Communications Agency, staffed with military information security experts, is in charge of making sure that the President's cellular phone isn't getting hacked by adversaries who might otherwise be able to listen in on his calls, capture his messages, intercept his search history, and remotely operate his camera and microphone. Donald Trump routinely […]
Businesses big and small use Microsoft Excel for everything from data visualization to bookkeeping, and chances are you’ve already had some exposure to this ubiquitous tool. Whether you’re looking to improve your hiring potential or boost your Excel efficiency, the Ultimate All-Level Excel Bootcamp can get you Excel-savvy with nearly 70 hours of training, and it’s […]
The workday is long, and inevitably, you’re going to find yourself needing to take a break from the daily grind. With Mini Materials Miniature Cinder Blocks, you can take some time for yourself and decompress by turning your desk into a miniature construction site. They’re available today in the Boing Boing Store for $22.49. Handmade […]
Handheld radios might seem a bit archaic, but in an emergency situation, few things will keep you as reliably connected to the outside world. This Emergency Multi-Function Radio & Flashlight takes the utility of the tried-and-true radio and combines it with a powerful flashlight and self-sufficient energy system. It’s available in the Boing Boing Store for […]