Slashdot Mirror
Author Kills DarkComet Spyware After Syria Uses It
judgecorp writes "DarkcoderSc (Jean-Pierre Lesueur) has ended the DarkComet Remote Access Tool (RAT) project, after it emerged that the Syrian government had used the software to spy on its opponents. The tool was also used to target Mac OS X systems last year."
So this was... legal malware?
Hacking / security testing software is legal, it's its usage that could be illegal.
Can someone clue me in on the history of this utility? As far as I can tell, this looks like proof-of-concept/research malware designed to be used for testing purposes, but that's the best I can gather.
It was a RAT (Remote Administration Tool, strict relative of a trojan horse), it could, in effect, be used for good purposes (or for learning purposes, but, without sources, the chanches for this are lesser), however yes, it was mainly a PoC and an exercise in style.
[OT] However, old news is old.
Authors of RAT's usually claim they are for legal uses only, only to be used on computers you are allowed access to. Claiming it is like a VNC server, even though they are straight up trojan horses. I don't know of any trojan author who has gotten into legal issues who wasn't also involved in viruses / worms / bot nets.
So Windows RDT is a hack tool? What about all the remote administration that's done in corporate environments? My security team can remote into my computer at any time and view everything I'm doing... they can move files around, download stuff... whatever they'd like... all without me knowing a thing. Is that a trojan? I use a RAT to control remote PC on my network that just plays music on my porch. Is that a trojan? There's plenty of stuff this kind of thing is useful for that's not illegal.
In Japan it's illegal to write or even save a virus to your computer. Apparently you get 3 years of jail time for writing and 2 years for acquire a virus.
Citation: http://www.futuregov.asia/articles/2011/jun/22/japan-enacts-anti-computer-virus-law/
No, GoToMyPC and LogMeIn don't have a built in option to inject the server code into a running iexplorer.exe process to disguise itself as a trusted program to bypass firewalls like DarkComet or other spyware.