4 ms·

I mean, there's probably more than enough intent here for prosecution. There's a fairly significant difference in selling a RAT that does remote administration,

I mean, there's probably more than enough intent here for prosecution. There's a fairly significant difference in selling a RAT that does remote administration, and selling a RAT that includes bulletpoint features to evade antivirus detection, persist through removals, and other features explicitly against the wishes of the device owner while the author actively and exclusively only advertises on script-kiddie forums and provides advice and encouragement of malicious infections. I don't think I've ever seen people gone after for the former, even when it's been abused by miscreants. At least in the US, people already "go after" security researchers all the time (at least the companies not smart enough to realise just how much a well meaning email can save them).

jascii 7y ago
For what it's worth: I have tracked, managed, and recovered hundreds of devices using tools that were hardent against detection and removal at the express request of the device owners in enterprise, educational, and private settings. Mobile asset tracking is a thing. So yeah, there is a legitimate use for that too.
- TheOtherHobbes 7y ago
  A key requirement under UK law is unauthorised access. If someone explicitly asks you to hack their systems (and they have permission themselves), or if you want to do pentesting and hardening or your own systems, you should be fine. The grey area here is how likely it is that someone would buy this tool for legitimate security analysis. Most people wouldn't, which puts it on a slippery slope. A good defending lawyer should be able to make a good case for genuine legitimate use, but of course that's still going to leave some risk, not to mention a lot of stress and inconvenience before a case even gets to trial.
larssorenson 7y ago
It is worth noting that there exists legitimate RATs that offer the bullet point features you've highlighted. The marketing issue is another problem entirely; these legitimate projects are usually open source on GitHub or posted on public blogs.
dang 7y ago
Your comments in this thread are fine and welcome, but trollish usernames are not ok. They troll every thread the account posts to: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20trollish%20username&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... Do you mind picking a non-trollish username and letting us rename it for you?
- nested_callback 7y ago
  Sure. My apologies, didn't mean to offend - came from reddit. I'll take 'nested_callback' if it's available.
  - dang 7y ago
    Ok, you are no longer EAT_ASS. You are now https://news.ycombinator.com/user?id=nested_callback https://news.ycombinator.com/user?id=nested_callback.

jascii 7y ago

For what it's worth: I have tracked, managed, and recovered hundreds of devices using tools that were hardent against detection and removal at the express request of the device owners in enterprise, educational, and private settings. Mobile asset tracking is a thing. So yeah, there is a legitimate use for that too.

TheOtherHobbes 7y ago
A key requirement under UK law is unauthorised access. If someone explicitly asks you to hack their systems (and they have permission themselves), or if you want to do pentesting and hardening or your own systems, you should be fine. The grey area here is how likely it is that someone would buy this tool for legitimate security analysis. Most people wouldn't, which puts it on a slippery slope. A good defending lawyer should be able to make a good case for genuine legitimate use, but of course that's still going to leave some risk, not to mention a lot of stress and inconvenience before a case even gets to trial.

larssorenson 7y ago

It is worth noting that there exists legitimate RATs that offer the bullet point features you've highlighted. The marketing issue is another problem entirely; these legitimate projects are usually open source on GitHub or posted on public blogs.

dang 7y ago

Your comments in this thread are fine and welcome, but trollish usernames are not ok. They troll every thread the account posts to: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20trollish%20username&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... Do you mind picking a non-trollish username and letting us rename it for you?

nested_callback 7y ago
Sure. My apologies, didn't mean to offend - came from reddit. I'll take 'nested_callback' if it's available.
- dang 7y ago
  Ok, you are no longer EAT_ASS. You are now https://news.ycombinator.com/user?id=nested_callback https://news.ycombinator.com/user?id=nested_callback.