Printable View
I kind of got to this because of another post.. It got me thinking...
What is a R.A.T.?
I consider a RAT to be a Remote Access Trojan. The name indicates it's not "A Good Thing(tm)".
But I've also seen Remote Administration Tool. This could be anything and it suggests something benign. Like the good ol' RDP. But Netbus also get's called Remote Administration Tool. And I consider Netbus to be a Remote Access Trojan.
So what is it?
RDP. maybe a Remote Access Terminal?
Acronyms that have multiple interpretations are not new to IT. I say it's meaning should be based on context. For example, if you're talking about Sub7, then I would go with Remote Access Trojan. Make sense?
--Th13
Hi SireDice
the way i look at it is tis way,if the R.A.T. is there right in my face and not pretending to be
something else,i will call it a remote administration tool.
If on the other hand you sneak it onto my comp by false pretenses i will call it a remote access trojan.
Regards
Mike
1 a : any of numerous rodents (Rattus and related genera) differing from the related mice by considerably larger size and by structural details (as of the teeth) b : any of various similar rodents
2 : a contemptible person: as a : one who betrays or deserts friends or associates b : SCAB 3b c : INFORMER 2
3 : a pad over which a woman's hair is arranged
4 : a person who spends much time especially idly in a specified place <a mall rat>
WHAT A POINTLESS QUESTION
Context, hmm, yes, I can see that...
But then again some companies are really messing things up:
From: http://www3.ca.com/securityadvisor/p...x?id=453075754Quote:
RAT : A Remote Administration Tool, or RAT, is a Trojan that when run, provides an attacker with the capability of remotely controlling a machine via a ""client"" in the attacker's machine, and a ""server"" in the victim's machine. Examples include Back Orifice, NetBus, SubSeven, and Hack'a'tack.
I'd say that's a Remote Access Trojan....
Ok guys
I write ladder diagrams and control process software that controls factory's i.e. PLC programs.
I have remote control software installed on most sites. if in the case of a process failure i can log into the computer from anywhere and fix the fault.The "RAT" is installed by client request so as to cut downtime .
Now do we call this RAT a tool or a Trojan :)
Regards
Mike
Is a fuzzy little 4 legged rodent that lurks in basements.
Apparently when you are in new york you are never more than 30 ft from a rat.
Hey Hey,
I'd actually never heard the term Remote Access Trojan before... at least not as the definition of R.A.T.
I've always heard Remote Administration Tool and I think that is a pretty accurate term...
If you're using VNC, RDP or slarty's GenControl (I think it was slarty.. .nice software either way).... or if you're using BO2k, Sub7 or Netbus... you're remotely controlly the machine... Sounds to be like Remote Administration. I know lots of people that use Netbus with a password to Administrate some of their internal machines...
I'd say the bigger problem here is the definition of a Trojan... Does it have to have a server listening? If so that rules out GenControl because it enables the server itself....Does the service have to be well hidden? Because VNC and RDP are easy to discover, but so is Netbus or Sub7... the files are clearly identifiable.
It's really a moot point.... regardless of whether it's a Remote Access Trojan, Remote Access Tool or Remote Administration Trojan or Remote Administration Tool, they're all designed for the same purpose... Sure, some of them are used maliciously, but any of them could be used maliciously...
Can you really define where you draw the line?
Peace,
HT
hey all,
me not a great wizkid or phreak..but just found this little text from a site.
The best example of an area causing the anti-virus researchers problems is the Trojans. Anyone responsible for malware analysis knows how true the saying is: 'A Trojan to one user is just a utility to another (and vice versa).' This statement is particularly applicable to one type of Trojan - the backdoors. Depending on the point of view, very often, the same program may be perceived as a Remote Administration Tool (RAT) or as a Remote Access Trojan (RAT) allowing a potentially malicious user to remotely control the system.
You might want to look back at the text and see what was exactly being refered.
Regards
rage.
Definitely some good points HT :)
From the same site that defines RAT as a Remote Administration Tool (see above), RAT as Remote Access Trojan:
From: http://www3.ca.com/Solutions/Collate...?CID=37734&ID=Quote:
The second scenario describes a condition that occurs when your pc’s security is compromised by a “backdoor” or “remote access trojan” (also rather appropriately referred to as a RAT). This particular type of trojan has been steadily gaining in popularity over the last couple of years and new backdoors are still being discovered with alarming frequency.
I can create a Trojan that doesn't have a server listening... It just nukes your config while showing some nude pictures ;)Quote:
I'd say the bigger problem here is the definition of a Trojan... Does it have to have a server listening? If so that rules out GenControl because it enables the server itself....Does the service have to be well hidden? Because VNC and RDP are easy to discover, but so is Netbus or Sub7... the files are clearly identifiable.
I would consider ANY program, that seems to do one thing but actually does something else, a trojan.
Good point... I could create an installer for a screensaver that silently switches on RDP and gives me full access. Now I've created a trojan using a well-known and trusted Remote Administration Tool.Quote:
It's really a moot point.... regardless of whether it's a Remote Access Trojan, Remote Access Tool or Remote Administration Trojan or Remote Administration Tool, they're all designed for the same purpose... Sure, some of them are used maliciously, but any of them could be used maliciously...
I am about halfway through Kevin Mitnick's new book, the Art of Intrusion, ironically i just finished a chapter where he spoke of RATs. He defined them as Remote Access Trojans, but he also lumped in any network tool, either malicious or legit as being under the RAT umbrella. He said, "programs like backorfice and terminal services are variations of RATs.
Now before I get flamed for this post, let me take the wind out of your sail and say that I do not believe everything out of ole' Kev's mouth is gold. I just thought it was ironic that I just read it.