Cyberstudy
PDF p.338 In progress

Backdoors and Remote Access Trojans

Open PDF at p.338 15 flashcards

Summary

PDF p.338

Backdoors are access methods that bypass usual authentication to give remote administrative control. Remote Access Trojans (RATs) are covert backdoor malware that mimic legitimate remote control programs, allowing threat actors to control compromised hosts.

Detailed explanation

PDF p.338
  • Backdoors
    • Definition: Circumvent usual authentication methods.
    • Function: Provide remote administrative control.
    • Creation: Can be intentional (for testing) or due to misconfiguration.
  • Remote Access Trojans (RATs)
    • Definition: Covert backdoor malware.
    • Function: Allows remote access, file uploads, software installation, and "live off the land" techniques.
    • Terminology: RAT can also mean remote administration tool.
    • Compromised Hosts: Often referred to as zombies.
  • Bots and Botnets
    • Bots: Automated scripts or tools performing malicious activities.
    • Botnets: Groups of bots controlled by the same malware instance, used for DDoS attacks, spam campaigns, or cryptomining.
    • Control: Managed through command and control (C2) networks.
  • Command and Control (C2) Networks
    • Function: Establish connections from compromised hosts to C2 hosts.
    • Detection: Network connections are key to identifying RATs, backdoors, or bots.
    • Implementation: Historically used IRC; modern methods use HTTPS or DNS traffic.

Important terms

taken from the text above
Backdoors
Circumvent usual authentication methods.
Creation
Can be intentional (for testing) or due to misconfiguration.
Remote Access Trojans (RATs)
Covert backdoor malware.
Terminology
RAT can also mean remote administration tool.
Compromised Hosts
Often referred to as zombies.
Bots
Automated scripts or tools performing malicious activities.
Botnets
Groups of bots controlled by the same malware instance, used for DDoS attacks, spam campaigns, or cryptomining.
RATs Remote Access Trojans

What I should remember

Key Points PDF p.338
  • Backdoors
    • Bypass Authentication: Provide remote control.
    • Creation: Intentional or due to misconfiguration.
  • RATs
    • Covert Malware: Mimics legitimate remote control programs.
    • Functions: Remote access, file uploads, software installation.
    • Terminology: Also known as remote administration tools.
  • Bots and Botnets
    • Bots: Perform malicious activities.
    • Botnets: Controlled groups of bots.
    • Uses: DDoS attacks, spam, cryptomining.
  • C2 Networks
    • Connections: Key for identifying threats.
    • Implementation: Uses covert channels like HTTPS or DNS.