RAT Vulnerabilities Turn Hackers into Victims

  /     /     /  
Publicated : 22/11/2024   Category : security


RAT Vulnerabilities Turn Hackers into Victims


A small number of Remote Administration Tools have vulnerabilities which can enable attack targets to turn the tables on threat actors.



Threat actors using certain Remote Administration Tools (RATs) may find themselves on the receiving end of malware. Newly discovered vulnerabilities in these tools may enable cybercriminals targets to turn the tables on their attackers and deliver malware.
Targeted cyberattacks hit thousands of businesses each year. Oftentimes victims label these threats as advanced and persistent to suggest they were inevitable, as though attackers are too sophisticated for defenders to protect themselves.
In many cases this is far from the truth, argues Waylon Grange, senior threat researcher at Symantec. Vulnerabilities in multiple hacker tools can be used against threat actors.
In looking at APT reports over the years, he says, there is a pattern of common RATS used in multiple campaigns. Frequently cited tools include Gh0stRAT, Korplug/Plug-X, and XtremeRAT, among others. The command-and-control components of these tools have vulnerabilities that can be exploited by attacker targets, who can turn the tables on their assailants.
The attacker who was the attacker is now the victim, says Grange of the exploits capabilities, which could enable a target to remote into an attackers machine and browse it. The tools can expose them to more vulnerabilities than the people theyre targeting in some ways.
At this years Black Hat USA conference in Las Vegas, Grange will disclose several exploits that could allow for remote execution or remote information disclosure on machines running these common C&C components. His talk is titled
Digital Vengeance: Exploiting the Most Notorious C&C Toolkits
.
The idea is not to give a lesson in hacking back but to warn actors of the consequences of using these RATs. One of the tools he will discuss is Gh0stRAT, which has been around for at least 10 years and used in attacks believed to have been by Chinese nation-state actors.
Gh0stRAT allows an adversary access to the targets machine. Once malware is downloaded they can monitor keystrokes, see the screen, capture audio, and view the webcam. It stays on the machine and will continue to run after rebooting.
Its fairly easy to recognize, says Grange. Most antivirus products pick it up right away because it has been around for so long.
If a machines antivirus program discovers the Gh0stRAT component, he continues, people have developed a Python script to search the malware and pull out configuration information. This script can call home to the C&C address and provide data on the adversarys location.
Armed with the location of the attackers server, a victim can install malware back on the adversarys machine and view their screen and files.
I can see who the adversary has as their targets, says Grange. If theyre remote controlling someone else, I can see what connections they have to others; what files they may have gotten off other targets.
Its worth noting this is not currently legal and Grange conducted his research in a test environment and attacked his own machines. He anticipates if this is made legal in the future, many businesses will want to use it to retaliate against adversaries -- a practice he thinks wont achieve much in making real progress against cybercrime.
Where I see this most useful is in terms of researching, he continues. Attribution is hard. If you can see where they are and what they target, that can provide a lot of valuable insight into attribution. Its most useful for researchers as opposed to a revenge tool.
Grange says these findings indicate modern attackers are not as untouchable as businesses think.
The tools they use are sloppy, are broken, he says. Its not an excuse to say we were hit by a nation-state so we cant be held accountable for what happened. They still play on the same playing field.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the
conference schedule
 and
to register.
 
Related Content:
Rise of Nation State Threats: How Can Businesses Respond?
Major Websites Vulnerable to their Own Back-End Servers
Android Security Apps for BYOD Users
WannaCry Forces Honda to Take Production Plant Offline

Last News

▸ Debunking Machine Learning in Security. ◂
Discovered: 23/12/2024
Category: security

▸ Researchers create BlackForest to gather, link threat data. ◂
Discovered: 23/12/2024
Category: security

▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂
Discovered: 23/12/2024
Category: security


Cyber Security Categories
Google Dorks Database
Exploits Vulnerability
Exploit Shellcodes

CVE List
Tools/Apps
News/Aarticles

Phishing Database
Deepfake Detection
Trends/Statistics & Live Infos



Tags:
RAT Vulnerabilities Turn Hackers into Victims