Free file sharing services such as LimeWire, FrostWire and UTorrent in most forms is illegal (note: there are legal sources however this post is focusing on file-sharing of pirated content). The cost of music, software and other applications are becoming more expensive to accommodate lost revenue caused by piracy spread through file sharing. As the price goes up to make up lost revenue, more people join file sharing networks. It’s a vicious cycle. There is however a more important reason besides ethics, law and cost to not be involved with file sharing services. Like my mother use to say … “nothing is free in this world”. Most of the pirated goods from file sharing you believe are free actually come at a very high price to your system and privacy.
Nuclear RAT rootkit
There are many malicious applications used by hackers to gain access to a system. The worst form is a Rootkit. Rootkits gain full control of a system without the victim’s knowledge and typically are very hard to detect and remove. Many popular rootkits include covert channel communication tools to hide phone home attempts from modern security tools. The rootkit example above is called Nuclear RAT (Remote Access Tool found at nuclearwintercrew.com). The image is the RAT server GUI that manages connections from Rootkits placed on systems. Some spy options include seeing the victim’s screen, logging keystrokes, controlling the mouse, opening a remote shell and so on (see images). There are options to hide RAT such as Melt Server (deletes executable) and using Stealth Shell Folders so you won’t see it running. Once installed, an attacker owns your system.
Rootkits like RAT can be wrapped inside normal programs. A hacker can take a common program like Photoshop and wrap it with RAT. When a user executes Photoshop, they actually install both Photoshop and RAT. Wrapping can be done with almost any file type so don’t think avoiding .exe on a file share will keep you safe! Senna is a popular wrapping software. The picture below shows wrapping the default windows calculator program with RAT. To do this, I choose the safe file (calc.exe) and rootkit. Once it’s wrapped, anytime somebody runs the calculator, the calculator will functional normally however my rootkit will be installed in the background and all evidence of its existence will be hidden. Only a very skilled forensic investigation would be able to detect its presence. Imagine normal applications such as outlook or explorer wrapped with a rootkit and spread across your network. This is how compromising one system could lead to compromising the entire network!
Developing Trojan software for file sharing is that easy. Any script kitty can Google “Rootkit”, “Application Wrapper”, pick a common desired software and build malware in a matter of minutes. So, do you still NEED that Snoop Dog remix of My Shorona? How about that pirated movie recorded with a hidden camera? Are you not willing to fork over a few hundred dollars for the latest Photoshop? Well go start file sharing and trade over control of your computer and privacy. Is your computer worth the trade? How about all the information you access such as bank accounts, company records and other sensitive data. If you look at the options for RAT above, you will see Webcam. Imagine what that means (hint, don’t undress in front of your computer).