What is a RAT?

[SirDice]

I kind of got to this because of another post.. It got me thinking...

What is a R.A.T.?

I consider a RAT to be a Remote Access Trojan. The name indicates it's not "A Good Thing(tm)".
But I've also seen Remote Administration Tool. This could be anything and it suggests something benign. Like the good ol' RDP. But Netbus also get's called Remote Administration Tool. And I consider Netbus to be a Remote Access Trojan.

So what is it?

[cacosapo]

RDP. maybe a Remote Access Terminal?

[thehorse13]

Acronyms that have multiple interpretations are not new to IT. I say it's meaning should be based on context. For example, if you're talking about Sub7, then I would go with Remote Access Trojan. Make sense?

--Th13

[titanmike]

Hi SireDice
the way i look at it is tis way,if the R.A.T. is there right in my face and not pretending to be
something else,i will call it a remote administration tool.
If on the other hand you sneak it onto my comp by false pretenses i will call it a remote access trojan.
Regards
Mike

[unhappy]

1 a : any of numerous rodents (Rattus and related genera) differing from the related mice by considerably larger size and by structural details (as of the teeth) b : any of various similar rodents
2 : a contemptible person: as a : one who betrays or deserts friends or associates b : SCAB 3b c : INFORMER 2
3 : a pad over which a woman's hair is arranged
4 : a person who spends much time especially idly in a specified place <a mall rat>

WHAT A POINTLESS QUESTION

[SirDice]

Context, hmm, yes, I can see that...
But then again some companies are really messing things up:

RAT : A Remote Administration Tool, or RAT, is a Trojan that when run, provides an attacker with the capability of remotely controlling a machine via a ""client"" in the attacker's machine, and a ""server"" in the victim's machine. Examples include Back Orifice, NetBus, SubSeven, and Hack'a'tack.

From: http://www3.ca.com/securityadvisor/p...x?id=453075754

I'd say that's a Remote Access Trojan....

[titanmike]

Ok guys
I write ladder diagrams and control process software that controls factory's i.e. PLC programs.
I have remote control software installed on most sites. if in the case of a process failure i can log into the computer from anywhere and fix the fault.The "RAT" is installed by client request so as to cut downtime .
Now do we call this RAT a tool or a Trojan
Regards
Mike

[mark_boyle2002]

Is a fuzzy little 4 legged rodent that lurks in basements.

Apparently when you are in new york you are never more than 30 ft from a rat.

[HTRegz]

Hey Hey,

I'd actually never heard the term Remote Access Trojan before... at least not as the definition of R.A.T.

I've always heard Remote Administration Tool and I think that is a pretty accurate term...

If you're using VNC, RDP or slarty's GenControl (I think it was slarty.. .nice software either way).... or if you're using BO2k, Sub7 or Netbus... you're remotely controlly the machine... Sounds to be like Remote Administration. I know lots of people that use Netbus with a password to Administrate some of their internal machines...

I'd say the bigger problem here is the definition of a Trojan... Does it have to have a server listening? If so that rules out GenControl because it enables the server itself....Does the service have to be well hidden? Because VNC and RDP are easy to discover, but so is Netbus or Sub7... the files are clearly identifiable.

It's really a moot point.... regardless of whether it's a Remote Access Trojan, Remote Access Tool or Remote Administration Trojan or Remote Administration Tool, they're all designed for the same purpose... Sure, some of them are used maliciously, but any of them could be used maliciously...

Can you really define where you draw the line?

Peace,
HT

[netrage]

hey all,

me not a great wizkid or phreak..but just found this little text from a site.

The best example of an area causing the anti-virus researchers problems is the Trojans. Anyone responsible for malware analysis knows how true the saying is: 'A Trojan to one user is just a utility to another (and vice versa).' This statement is particularly applicable to one type of Trojan - the backdoors. Depending on the point of view, very often, the same program may be perceived as a Remote Administration Tool (RAT) or as a Remote Access Trojan (RAT) allowing a potentially malicious user to remotely control the system.


You might want to look back at the text and see what was exactly being refered.


Regards
rage.