The Blackshades Remote Access Trojan

[socafighter]

The Blackshades Remote Access Trojan
June 09, 2014 by Burn World in BurnWorld.com





The Blackshades Remote Access Trojan
Michael Hogue’s Attempt to Infect the Internet

by Andrew Buckmaster BurnWorld.com

The Remote Access Trojan (or RAT as it’s sometimes called) is a very powerful and very dangerous type of Trojan virus. RAT mini programs are usually known as a Remote Administration Tool and they can be quite useful for a number of administrative tasks. The RAT viruses are a subset of tasks that function in a similar manner. Unlike Remote Administration Tools, a RAT serves darker purposes. A RAT essentially spies on the infected computer in a number of ways. It may install various malware programs that could seriously threaten your system. A RAT could steal personal data (such as banking details, pin numbers, etc). In the past two years, a specific RAT has differentiated itself as the most threatening of all Remote Access Trojans: the Blackshades NET Remote Access Trojan. The virulence and harmful potential of this spyware are so great, that cyber security organizations concentrated their efforts on bringing down this crime network as soon as possible. They just recently made a breakthrough on the matter. But more about the investigation and the arrests made will be detailed later. For now, let’s return to the Blackshades NET Remote Access Trojan.

The most frightening aspect of a RAT like Blackshades is that it’s capable of creating a Ransom Malware or Ransomware situation at any time. In such a situation, the computer’s system is hijacked. The user may even be locked out of his or her system completely. The user will then have to satisfy a ransom in order to regain access to his or her files. The personal data which a RAT is capable of extracting from a system can be used for all types of security threats: identity theft, banking security breach, loss of authentication details for a number of vital services. The list goes on and on.

The Blackshades Remote Access Trojan Virus and Its Creators

The Blackshades spyware RAT is produced by a company of the same name. The Blackshades company produces new versions of the virus quite often. The Blackshades company claims (most likely to protect themselves from litigation) that they allow users to install their program out of their own free will. They state that the program will allow users to spy on the activity of others using their computer. You’re probably asking yourselves why anyone would want to spy on their own computer. Nevertheless, an entire industry exists based on spying on other people through software and security cameras. The Blackshades virus doesn’t limit itself to agreed installs. Instead, it spreads through networks as most malware threats do: by fake links in emails and socializing networks; by installing seemingly different programs. The hackers have many techniques to infect others.

Fortunately, the company’s shoddy legal coverage wasn’t enough to elude the law. After conducting a dozen raids around the world, the FBI discovered the cybercrime network behind the Blackshades attacks. They managed to arrest more than 100 people worldwide. If you recall, the Bureau made previous arrests back in 2012. The arrests included over 20 individuals. Michael Hogue (xVisceral), the malware’s lead coder, was among those arrested.

Despite of the mass arrests of 2012, the Blackshades RAT continued to infect computers worldwide at an increased rate. But with this new wave of recent arrests in May 2014, authorities hope that they put the main perpetrators of this cybercrime behind bars. Their hope is that arresting the leaders of the Blackshades NET Remote Acess Trojan will cause the virus to lose its presence on the web.

Among the people recently arrested were also 5 American citizens charged with being part of this cybercrime network of hackers. Further trail is needed before assessing guilt. The potential for harm and invasiveness of this RAT is frightening. One of the people accused during this recent wave of arrests, for example, used the program to take pictures of unsuspecting women and girls that were in range of the infected computers’ webcams. The potential this malware possesses for blackmailing with information is huge.

According to the FBI, currently, more than half a million computers are infected worldwide. Hopefully the recent cybercrime takedown will help make our computers safer. But, we can’t dismiss the fact that the many iterations and reiterations of this Trojan could change the face of online security and cybercrime forever. Ever since its source code was leaked on a forum in 2013, getting a grip on all copies of Blackshades has become increasingly difficult. Experts believe that hackers will gradually reorient towards other Trojans from now on. However, no one has commented as to whether this is good or bad. The next batch of Trojans could be even more powerful than Blackshades. Luckily, we’ve included a list of precautionary tips you can use to help keep yourself safe.

Tips on Protecting Your Computer

In addition to rules common to all threats (like never opening websites with untrusted security certificates), you should consider looking into a few good antivirus programs that are capable of dealing with the Blackshades Trojan. Here are a few suggestions:

•Symantec: This program protects users from the Blackshades activity under three detection names (W32.Shadesrat, W32.Shadesrat.B and W32.Shadesrat.C). Even if you’re not a Symantec user, they offer you a free Norton-based tool to remove the malware from your system in case you suspect you have an infection.

•Norton Anti-Virus: This is another option for getting rid of Blackshades. No anti-virus is 100% perfect at protecting against and removing Blackshades. This is as good as it gets to perfection.

•Spyhunter: This program is not so much of an anti-virus, but a competent scanner that can detect malware within your system.

If you suspect you have this Trojan virus in your computer, the FBI has a program they recommend you run to detect it. You can check out the scanner here. If the answer is positive, I highly recommend you use one of the above programs to remove it from your computer immediately.


FBI ......http://www.fbi.gov/news/stories/2014/may/international-blackshades-malware-takedown/could-your-computer-be-infected-by-blackshades