3 ms·

For the people that think this is legitimate software, this is not legitimate software. It is sold and encouraged as malware, used to blackmail girls (barely wo

For the people that think this is legitimate software, this is not legitimate software. It is sold and encouraged as malware, used to blackmail girls (barely women) - that's what "cam capture" is for - keylogger, general malware, backconnect proxy, auto-start and persistence. See https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-down-under/ https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-d... for more details and screenshots/quotes of posts by the creator of the tool. This is _not_ for server administration. This is _not_ like PuTTY or Remote Desktop. This is like Blackshades or Orcus. It is malicious, only sold for malicious usage.

jascii 7y ago
I don't think anyone seriously doubts the intended, arguable unethical, use of IM-RAT. The question is whether authoring and or selling these tools is or should be illegal. I'd argue that would set a dangerous precedent allowing governments to go after any security researchers whenever they feel it convenient to do so.
- nested_callback 7y ago
  I mean, there's probably more than enough intent here for prosecution. There's a fairly significant difference in selling a RAT that does remote administration, and selling a RAT that includes bulletpoint features to evade antivirus detection, persist through removals, and other features explicitly against the wishes of the device owner while the author actively and exclusively only advertises on script-kiddie forums and provides advice and encouragement of malicious infections. I don't think I've ever seen people gone after for the former, even when it's been abused by miscreants. At least in the US, people already "go after" security researchers all the time (at least the companies not smart enough to realise just how much a well meaning email can save them).
  - jascii 7y ago
    For what it's worth: I have tracked, managed, and recovered hundreds of devices using tools that were hardent against detection and removal at the express request of the device owners in enterprise, educational, and private settings. Mobile asset tracking is a thing. So yeah, there is a legitimate use for that too.
    - TheOtherHobbes 7y ago
      A key requirement under UK law is unauthorised access. If someone explicitly asks you to hack their systems (and they have permission themselves), or if you want to do pentesting and hardening or your own systems, you should be fine. The grey area here is how likely it is that someone would buy this tool for legitimate security analysis. Most people wouldn't, which puts it on a slippery slope. A good defending lawyer should be able to make a good case for genuine legitimate use, but of course that's still going to leave some risk, not to mention a lot of stress and inconvenience before a case even gets to trial.
  - larssorenson 7y ago
    It is worth noting that there exists legitimate RATs that offer the bullet point features you've highlighted. The marketing issue is another problem entirely; these legitimate projects are usually open source on GitHub or posted on public blogs.
  - dang 7y ago
    Your comments in this thread are fine and welcome, but trollish usernames are not ok. They troll every thread the account posts to: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20trollish%20username&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... Do you mind picking a non-trollish username and letting us rename it for you?
    - nested_callback 7y ago
      Sure. My apologies, didn't mean to offend - came from reddit. I'll take 'nested_callback' if it's available.
      - dang 7y ago
        Ok, you are no longer EAT_ASS. You are now https://news.ycombinator.com/user?id=nested_callback https://news.ycombinator.com/user?id=nested_callback.
msla 7y ago
https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School_District https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School... > Robbins v. Lower Merion School District is a federal class action lawsuit,[2] brought in February 2010 on behalf of students of two high schools in Lower Merion Township, a suburb of Philadelphia.[3] In October 2010, the school district agreed to pay $610,000 to settle the Robbins and parallel Hasan lawsuits against it.[1] > The suit alleged that, in what was dubbed the "WebcamGate" scandal, the schools secretly spied on the students while they were in the privacy of their homes.[4][5] School authorities surreptitiously and remotely activated webcams embedded in school-issued laptops the students were using at home.[6][7] After the suit was brought, the school district, of which the two high schools are part, revealed that it had secretly taken more than 66,000 images.[8][9] The suit charged that in doing so the district infringed on its students' privacy rights.[6][10][11] A federal judge issued a preliminary injunction, ordering the school district to stop its secret webcam monitoring, and ordered the district to pay the plaintiffs' attorney fees.[12][13][14] > The lawsuit was filed after 15-year-old high school sophomore (second year student) Blake Robbins was disciplined at school for his behavior in his home. Acknowledging that the school was found to have been in the wrong and that the courts came down on the side of privacy, is the company which sold the school district the software they used to violate privacy guilty of anything? Should it be? The company involved: https://en.wikipedia.org/wiki/HEAT_LANrev https://en.wikipedia.org/wiki/HEAT_LANrev ... said its software was intended to be used for theft recovery. Easier to recover stolen goods if the laptop can surreptitiously take pictures of its surroundings and send them home, see? Is that software inherently bad, like the software you're talking about is? It could certainly be used for the same thing.
- ClumsyPilot 7y ago
  I remember that case, and I am surprised criminal charges were not considered against the school officials. Back to the matter at hand, I think the installation process can serve as a litmus test. If the software requires effective ownership of the device for initial installation, it would be of limited use as malware. Typical DRM software has characteristics of malware.

jascii 7y ago

I don't think anyone seriously doubts the intended, arguable unethical, use of IM-RAT. The question is whether authoring and or selling these tools is or should be illegal. I'd argue that would set a dangerous precedent allowing governments to go after any security researchers whenever they feel it convenient to do so.

nested_callback 7y ago
I mean, there's probably more than enough intent here for prosecution. There's a fairly significant difference in selling a RAT that does remote administration, and selling a RAT that includes bulletpoint features to evade antivirus detection, persist through removals, and other features explicitly against the wishes of the device owner while the author actively and exclusively only advertises on script-kiddie forums and provides advice and encouragement of malicious infections. I don't think I've ever seen people gone after for the former, even when it's been abused by miscreants. At least in the US, people already "go after" security researchers all the time (at least the companies not smart enough to realise just how much a well meaning email can save them).
- jascii 7y ago
  For what it's worth: I have tracked, managed, and recovered hundreds of devices using tools that were hardent against detection and removal at the express request of the device owners in enterprise, educational, and private settings. Mobile asset tracking is a thing. So yeah, there is a legitimate use for that too.
  - TheOtherHobbes 7y ago
    A key requirement under UK law is unauthorised access. If someone explicitly asks you to hack their systems (and they have permission themselves), or if you want to do pentesting and hardening or your own systems, you should be fine. The grey area here is how likely it is that someone would buy this tool for legitimate security analysis. Most people wouldn't, which puts it on a slippery slope. A good defending lawyer should be able to make a good case for genuine legitimate use, but of course that's still going to leave some risk, not to mention a lot of stress and inconvenience before a case even gets to trial.
- larssorenson 7y ago
  It is worth noting that there exists legitimate RATs that offer the bullet point features you've highlighted. The marketing issue is another problem entirely; these legitimate projects are usually open source on GitHub or posted on public blogs.
- dang 7y ago
  Your comments in this thread are fine and welcome, but trollish usernames are not ok. They troll every thread the account posts to: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20trollish%20username&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... Do you mind picking a non-trollish username and letting us rename it for you?
  - nested_callback 7y ago
    Sure. My apologies, didn't mean to offend - came from reddit. I'll take 'nested_callback' if it's available.
    - dang 7y ago
      Ok, you are no longer EAT_ASS. You are now https://news.ycombinator.com/user?id=nested_callback https://news.ycombinator.com/user?id=nested_callback.

msla 7y ago

https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School_District https://en.wikipedia.org/wiki/Robbins_v._Lower_Merion_School... > Robbins v. Lower Merion School District is a federal class action lawsuit,[2] brought in February 2010 on behalf of students of two high schools in Lower Merion Township, a suburb of Philadelphia.[3] In October 2010, the school district agreed to pay $610,000 to settle the Robbins and parallel Hasan lawsuits against it.[1] > The suit alleged that, in what was dubbed the "WebcamGate" scandal, the schools secretly spied on the students while they were in the privacy of their homes.[4][5] School authorities surreptitiously and remotely activated webcams embedded in school-issued laptops the students were using at home.[6][7] After the suit was brought, the school district, of which the two high schools are part, revealed that it had secretly taken more than 66,000 images.[8][9] The suit charged that in doing so the district infringed on its students' privacy rights.[6][10][11] A federal judge issued a preliminary injunction, ordering the school district to stop its secret webcam monitoring, and ordered the district to pay the plaintiffs' attorney fees.[12][13][14] > The lawsuit was filed after 15-year-old high school sophomore (second year student) Blake Robbins was disciplined at school for his behavior in his home. Acknowledging that the school was found to have been in the wrong and that the courts came down on the side of privacy, is the company which sold the school district the software they used to violate privacy guilty of anything? Should it be? The company involved: https://en.wikipedia.org/wiki/HEAT_LANrev https://en.wikipedia.org/wiki/HEAT_LANrev ... said its software was intended to be used for theft recovery. Easier to recover stolen goods if the laptop can surreptitiously take pictures of its surroundings and send them home, see? Is that software inherently bad, like the software you're talking about is? It could certainly be used for the same thing.

ClumsyPilot 7y ago
I remember that case, and I am surprised criminal charges were not considered against the school officials. Back to the matter at hand, I think the installation process can serve as a litmus test. If the software requires effective ownership of the device for initial installation, it would be of limited use as malware. Typical DRM software has characteristics of malware.