Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

DarkComet Developer Retires Notorious Remote Access Tool

Some call DarkComet a tool; others call it a Trojan. RAT had been used by Syrian police and anti-Tibet organizations to spy on targeted computers.

Who Is Anonymous: 10 Key Facts
Who Is Anonymous: 10 Key Facts
(click image for larger view and for slideshow)
The creator of a notorious remote access tool (RAT) known as DarkComet has announced that he's retiring the free software, effective immediately.

Developer Jean-Pierre Lesueur said on his DarkComet website that he decided to pull the plug after his software was used for illegal purposes, for which he didn't want to be held accountable. Lesueur, meanwhile, has also released--via the website--a free tool to detect any instance of DarkComet running on a computer, "even packed/compressed/virtualized etc.," as well as another tool "to extract the data in a darkcomet stub," he said.

"Why did I take such a decision? ... Because of the misuse of the tool, and unlike so many of you [I] seem to believe I can be held responsible [for] your actions, and if there is something I will not tolerate [it] is to have to pay the consequences for your mistakes and I will not cover for you," wrote Lesueur on his website. "The law is how it is and I must abide by the rules, yes it's unfortunate for [developers] in security but that's how it is. Without mentioning what happened in Syria ..."

What happened in Syria was this: Syrian police used DarkComet earlier this year to spy on opponents of President Bashar al-Assad. Likewise, DarkComet reportedly has been used to spy on pro-Tibet non-governmental organizations.

[ Read 8 Lessons From Nortel's 10-Year Security Breach. ]

Remote access tools have been available for some time, and used in numerous "low and slow" nation state attacks, as well as in advanced persistent threat attacks. But awareness of such tools increased markedly last year, after revelations that the Shady RAT series of attacks--attributed by many information security watchers to China--had successfully compromised at least 72 organizations, including 22 governmental agencies and contractors.

What can DarkComet or other RATs do? "This software allow you to make hundreds of functions [stealthily] and remotely without any kind of [authorization] in the remote process," Lesueur told security firm Sophos last year, in reference to DarkCometX, a then-in-development Mac version of his RAT.

Given that functionality, Chester Wisniewski, a senior security advisor at Sophos Canada, said the "RAT" term was a misnomer. "While the authors would like you to believe they are simply tools, I think the evidence suggests Trojan is more appropriate," he said.

DarkComet creator Lesueur has been careful to distinguish between how his software could be used legitimately or illegally. On his website, in response to a rhetorical question about whether just the act of using DarkComet would be illegal, he said: "Well it depends how you use it, if you use it to control remote machines without any authorization from the owner then yes, if you use it in your own network then it is fully legal."

Lesueur's retiring of DarkComet clearly is his attempt to avoid arrest or imprisonment for having built and distributed the free software. "While in the past authors of such tools believed that they were immune from prosecution by claiming that they were educational tools, arrests--starting with the alleged author of the infamous Mariposa botnet--have begun to wake up authors of such tools to the possibility that they could be breaking the law," according to a Symantec blog post.

"These arrests are sending a message to the authors of such tools that they are not above the law and could face prosecution for their actions," according to Symantec, which predicts that more developers of freeware RATs--and similar tools--will soon retire their wares. "Time will tell, but any similar closures due to the risk of prosecution must be seen as a step in the right direction in combating the risk posed by such freely available tools," the company said.

Employees and their browsers might be the weak link in your security plan. The new, all-digital Endpoint Insecurity issue of Dark Reading shows how to strengthen them. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Andrew Hornback
50%
50%
Andrew Hornback,
User Rank: Apprentice
7/12/2012 | 1:20:11 AM
re: DarkComet Developer Retires Notorious Remote Access Tool
"Well it depends how you use it, if you use it to control remote machines without any authorization from the owner then yes, if you use it in your own network then it is fully legal."

This is absolutely true, and I feel bad for the developer in this case. Building a tool, whether it's a set of scripts of a remote control package, that falls into the wrong hands and gets utilized for illegal activities shouldn't necessarily make you liable for what the user of the tool has done.

If you want to extend that theory - that the manufacturer is responsible for the use of what they manufacture - then a gun manufacturer that builds a gun that a thug then takes and kills someone with would then be held accountable for building the gun. At the other end of the spectrum, a cement company sells a 50 lb bag to an individual who then uses that product to create "cement overshoes" - who gets held liable at that point? Under this line of thinking, the cement company would be liable for murder.

I realize that other countries have different ways of looking at things than we do here, but the question that I ask is, "Does this really make sense?" - if you're creating a product that gets marketed as a way to attack other entities, you're liable. If it's simply a tool, should you really be held liable?

Andrew Hornback
InformationWeek Contributor
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-3995
PUBLISHED: 2020-10-20
In VMware ESXi (6.7 before ESXi670-201908101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x before 15.1.0), Fusion (11.x before 11.1.0), the VMCI host drivers used by VMware hypervisors contain a memory leak vulnerability. A malicious actor with access to a virtual machine may be able to tr...
CVE-2020-7363
PUBLISHED: 2020-10-20
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions.
CVE-2020-7364
PUBLISHED: 2020-10-20
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions.
CVE-2020-7369
PUBLISHED: 2020-10-20
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Yandex Browser version 20.8.3 and prior versions, and was fixed in version ...
CVE-2020-7370
PUBLISHED: 2020-10-20
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Bolt Browser version 1.4 and prior versions.