5 ms·

Thanks for posting the video, it's a nice demo of the tool. This is actually a really awesome program I could see myself using to control and monitor my own mac

by zaroth 10y ago

Thanks for posting the video, it's a nice demo of the tool. This is actually a really awesome program I could see myself using to control and monitor my own machines. Yes, this clearly has the kitchen sink of functionality thrown in. In many ways this looks like a platform for experimentation, with the developer clearly building this as a labor of love and learning as much, if not more so, than a commercial enterprise. > What exactly is the legitimate use of disabling the webcam indicator remotely? In a context menu labeled 'Swiss Army Knife' there's an option to Enable/Disable webcam light. There's also options like making the computer speaker beep. By the way, most video recording software provide options to toggle the webcam light in advanced menus. Under an option called 'NanoStress' you can send several traffic patterns. Yes, it even has a bit of iPerf built in. Frankly this is a really neat tool with tons of useful applications. It's highly distressing that this could get you raided and charged in Federal court with conspiracy.

tptacek 10y ago
You can see yourself installing a RAT with a keylogger, webcam light disabler, and SYN flood feature to manage your own computers?
- nadermx 10y ago
  Why not? Could be used to see if you have been hacked and there is something/someone else using it no? A different way to monitor the logs of a system
- FilterSweep 10y ago
  Are the features selectively installed, opt-in installed, or configured downloaded, as with most modern software?
- zaroth 10y ago
  Certainly, this program has a number of features which I needed on a daily basis in my WiFi testing lab. We had hundreds of headless machines running in isolation chambers which needed automated tools for remote controlling all aspects of the system. Back in the day, we programmed our own agent to do things like provide remote program execution, file system access, NDIS/OLE/DCOM control, traffic generation, packet capture, system profiling, key-press and mouse-click macros for UI automation, etc. We had many of the same options for automating how the agent was installed, such as customizing the build for automatic deployment across various environments. We had automated PXE combined with a Ghost program where we could snapshot and deploy images to the machines straight from a TCL API. We had ways to throw up screens on the UI to indicate tests were in progress and lock the machine for interactive use. About 15 years ago I actually spent several man-years building much of the functionality which is now contained within NanoCore. And while we didn't provide specifically SYN flood, we wrote wrappers for iperf to be able to load the executable onto the machine, and a TCL API around running iperf in server or client mode and capturing and parsing the output. We also wrote our own L2 traffic generator which trivially could have been used to generate SYN floods, although we were more interested in particular with generating "pure" traffic patterns to find the synthetic maximum possible throughput, as well as ideally sized packets for WiFi range and ACI testing. The Azimuth WSC -- as it was called -- met every definition of a modern day "RAT" except that of course it's official purpose wasn't malware.
  - RangerScience 10y ago
    You should think about writing up a statement and sending it to his legal defense.
  - bitexploder 10y ago
    FWIW, Apple's Remote Desktop tool does almost everything this guy's RAT does. Except: You can't disable webcam lights with it. And you can't SYN flood (directly) with it. It is trivial to run a few shell commands and install tools that let you SYN flood. Why would a RAT include that by default. I think it will come down to a couple of the small hard to justify features coupled with the overall packaging and history of the software that really spell out a story of intent from the author that lands him in jail. Intent, and the story, that gets told in court really matters. Plus we don't have the totality of the evidence.
- dllthomas 10y ago
  FWIW, I specifically wanted to disable the webcam light on my own computer and was both frustrated and relieved to discover it was - at least - difficult.
- emodendroket 10y ago
  He can see himself claiming that to make a point, anyway.

by zaroth 10y ago

tptacek 10y ago

You can see yourself installing a RAT with a keylogger, webcam light disabler, and SYN flood feature to manage your own computers?

nadermx 10y ago
Why not? Could be used to see if you have been hacked and there is something/someone else using it no? A different way to monitor the logs of a system
FilterSweep 10y ago
Are the features selectively installed, opt-in installed, or configured downloaded, as with most modern software?
zaroth 10y ago
Certainly, this program has a number of features which I needed on a daily basis in my WiFi testing lab. We had hundreds of headless machines running in isolation chambers which needed automated tools for remote controlling all aspects of the system. Back in the day, we programmed our own agent to do things like provide remote program execution, file system access, NDIS/OLE/DCOM control, traffic generation, packet capture, system profiling, key-press and mouse-click macros for UI automation, etc. We had many of the same options for automating how the agent was installed, such as customizing the build for automatic deployment across various environments. We had automated PXE combined with a Ghost program where we could snapshot and deploy images to the machines straight from a TCL API. We had ways to throw up screens on the UI to indicate tests were in progress and lock the machine for interactive use. About 15 years ago I actually spent several man-years building much of the functionality which is now contained within NanoCore. And while we didn't provide specifically SYN flood, we wrote wrappers for iperf to be able to load the executable onto the machine, and a TCL API around running iperf in server or client mode and capturing and parsing the output. We also wrote our own L2 traffic generator which trivially could have been used to generate SYN floods, although we were more interested in particular with generating "pure" traffic patterns to find the synthetic maximum possible throughput, as well as ideally sized packets for WiFi range and ACI testing. The Azimuth WSC -- as it was called -- met every definition of a modern day "RAT" except that of course it's official purpose wasn't malware.
- RangerScience 10y ago
  You should think about writing up a statement and sending it to his legal defense.
- bitexploder 10y ago
  FWIW, Apple's Remote Desktop tool does almost everything this guy's RAT does. Except: You can't disable webcam lights with it. And you can't SYN flood (directly) with it. It is trivial to run a few shell commands and install tools that let you SYN flood. Why would a RAT include that by default. I think it will come down to a couple of the small hard to justify features coupled with the overall packaging and history of the software that really spell out a story of intent from the author that lands him in jail. Intent, and the story, that gets told in court really matters. Plus we don't have the totality of the evidence.
dllthomas 10y ago
FWIW, I specifically wanted to disable the webcam light on my own computer and was both frustrated and relieved to discover it was - at least - difficult.
emodendroket 10y ago
He can see himself claiming that to make a point, anyway.