4

Is there a possibility that malware on a computer could be providing remote access to an external party without the computer user being aware? I.e., some kind of hidden active remote access tool?

I.e., the computer I am using now, is there some chance an external user is viewing my active desktop without me being aware of it?

7

Yes it's possible.

An obvious example would be a Remote Access Trojan (RAT). Once your computer is infected they can do essentially whatever they're set up to do. This includes monitoring your screen, logging keystrokes, and accessing webcams.

My personal experience with this was being infected with the Blackshades RAT a few years ago. I was monitored for about two days and on the final day the kid on the other end clearly got impatient with me and demanded to know multiple credentials via a chatbox he put in the middle of my screen.

My solution at the time was to remove my usb wireless card to prevent him from sending any further commands, format the computer, and reinstall from scratch.

  • This is a really important issue from my end, as I am looking at users who are using remote access tools (Citrix) on their laptops to access desktop computers. Because there is no configuration/health checks conducted on the laptops, I'm assuming there could be a RAT on a user's laptop which is viewing everything the laptop user is doing, which includes logging onto their desktop computers. So an external third party is using an unsafe laptop as a middleman for viewing information available on the user's desktop workstation. – KimberleyK Jun 30 '15 at 3:40
  • So essentially the existence of RATs in the real world means allowing users to use legitimate remote access tools (to connect to their desktop workstations) on whatever laptop they like is not a good idea. – KimberleyK Jun 30 '15 at 3:43
  • My organisation is using Citrix Receiver which as far as I am aware does not conduct health checks on end devices. – KimberleyK Jun 30 '15 at 3:44
  • As a result of the information you have provided it is likely we will be switching to something like ClearPass instead. – KimberleyK Jun 30 '15 at 3:44
  • Correct, if you don't actively make sure their laptops are clean and updated, there's the potential a RAT could be used to spy on them. It will monitor keyboard hooks/mouse clicks and record information regardless of whether it's in Remote Desktop Connection or something similar. – user72066 Jun 30 '15 at 23:21
4

Yes this is very possible. Remote Administration Tools (RATS) such a DarkComet or Blackshades are commonly used for this.

  • I made a few comments on the answer below if you would like to take a look. – KimberleyK Jun 30 '15 at 3:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.