6

I've started trying to increase my networking security at my house. One thing that worries me (because other people in the house are always downloading viruses that come along with "free" games) are RATs. In my ignorant understanding of how RATs work, they basically get you to download a 'server' that a 'client' connects to via a port that it opens on the host machine. However, if my host machine is behind a router, am I still safe?

  • They can also be a client that connects to a server that the attacker uses. – immibis Jul 13 '15 at 7:11
  • It's very unlikely that an attacker will be able to remotely control your machine (via RDP, VNC, etc) if one of your roommate's machines gets infected with any type of virus or remote access Trojan. Users on the same local network as you that get infected with any type of malware can always be a risk for your machine on that same network though. – shift_tab Jul 13 '15 at 13:59
  • RATS call home. You have to block their outbound traffic somehow, often by removing them. – Fiasco Labs Mar 27 '16 at 19:46
9

The communication between computer goes both ways, so there can be two cases:

  • The RAT is a server: this is the case for many well-known and legit remote access tools, like remote desktop, VNC etc... In this case, you need to allow port forwarding on your router to be able to access the computer.
  • The RAT is a client: the tool will try to connect to a "centre of command" somewhere the hacker can accept the inbound connection. Then the client offers a remote shell. In this case, there is no need for port forwarding on the router.
6

Only in the early days of hacking did RATs require the lack of firewall in order for the controller to connect. Take the famous example of SubSeven -- the RAT would install, and join an IRC channel advertising a port and IP address. If the victim was behind a firewall, the machine could not be manipulated -- the hacker would just get a connection timeout.

However, those days are long over. These days, RATs typically use a client connection to a command and control server to act as a middleman, thus bypassing the need to have an open port on a server. All they need is unfettered access to the internet.

In the Metasploit framework, meterpreter can be configured to do this in a very simple way via a "reverse_tcp" connection. In essence, you listen on some port on the internet, and the infected computer connects back to the hacker.

If access to the internet is locked down on the computer, let's say only to http and https and no other ports, meterpreter can go around that as well. It can be configured to connect back to its control server using a well-formed ActiveX session over HTTP or HTTPS that may even not trip up some intrusion detection systems. This is the tip of the iceberg in obfuscating command and control connections.

Note that it is possible to setup an open incoming port with a RAT via UPnP, but this is unreliable (as many routers don't support or have UPnP enabled) and not a common method.

  • Yep, and you don't even need an ActiveX session. There are many different ways around this. – Mark Buffalo Mar 27 '16 at 2:24
0

Although another malware infected machine on your network that is being RAT'd by an attacker can not "just RAT you", it can still attempt to zero-day your machine to install the same malware to accomplish the RAT task.

Zeus/SpyEye/Citadel etc malware and the like generally have proxy(SOCKS4-5)/RAT/ftp-backconnect capabilities as a standard, and they can 'pivot' the attackers traffic/attacks through those infected platforms to target your machine.

So.....

1) Install local firewall/AV (the standard measures)
2) Keep your applications! & Operating system up 2 date, its very important to also update your applications while you update your OS. 
3) Only install apps from locations you trust.
4) On a extreme note, stop/uninstall services or applications that you dont use, this reduces your attack surface. 

Good luck.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.