Remote Access Trojan :- A remote access Trojan (RAT) is a malware program that includes a back door for administrative control over the target computer. RAT are usually downloaded invisibly with a user-requested program -- such as a game -- or sent as an email attachment. Once the host system is compromised, the intruder may use it to distribute RAT to other vulnerable computers and establish a botnet. Because a RAT enables administrative control, it makes it possible for the intruder to do just about anything on the targeted computer, including: Monitoring user behavior through keyloggers or other spyware. Accessing confidential information, such as credit card and social security numbers. Activating a systems webcam and recording video. Taking screenshots. Distributing viruses and other malware. Formatting drives. Deleting, downloading or altering files and file systems. The Back Orifice rootkit is one of the best known examples of a RAT. A hacker group known as the Cult of the Dead Cow created Back Orifice to expose the security deficiencies of Microsofts Windows operating systems. RATs can be difficult to detect because they usually dont show up in lists of running programs or tasks. The actions they perform can be similar to those of legitimate programs. Furthermore, an intruder will often manage the level of resource use so that a drop in performance doesnt alert the user that somethings amiss. To protect your system from RAT, follow the same procedures you use to prevent other malware infections: Keep antivirus software up to date and refrain from downloading programs or opening attachments that arent from a trusted source. At the administrative level, its always a good idea to block unused ports, turn off unused services and monitor outgoing traffic. always analyze downloaded files from virustotal so as to check repudiation of the files via siganture scanning through most of popular av signatures.
Posted on: Tue, 28 Oct 2014 09:45:17 +0000
Trending Topics
Recently Viewed Topics
© 2015