Remote Administration Tools: a Comparative Study

Journal of Theoretical and Applied Information Technology

www.jatit.org

REMOTE ADMINISTRATION TOOLS: A COMPARATIVE STUDY

Anis Ismail, Mohammad Hajjar, Haissam Hajjar Department of Computer Network and Telecommunications Engineering University Institute of Technology – Saida Lebanese University Email: [email protected], [email protected]

ABSTRACT

One of the trends we have been observing for some time now is the blurring of divisional lines between different types of malware. Classifying a newly discovered 'creature' as a virus, a worm, a Trojan or a security exploit becomes more difficult and anti-virus researchers spend a significant amount of their time discussing the proper classification of new viruses and Trojans. Depending on the point of view, very often, the same program may be perceived as a Remote Administration Tool (RAT) allowing a potentially malicious user to remotely control the system. A Remote Administration Tool is a remote control software that when installed on a computer it allows a remote computer to take control of it. With remote control software you can work on a remote computer exactly as if you were right there at its keyboard. With fast, reliable, easy-to-use pc from remote control software, it lets you save hours of running up and down stairs between computers. Remote control software allows you to take control of another PC on a LAN, WAN or dial-up connection so you see the remote computer's screen on your monitor and all your mouse movements and keystrokes are directly transferred to the remote machine. Remote control software provides fast secure access to remote PC’s on Windows platforms. Hackers and malware sometimes install these types of software on a computer in order to take control of them remotely. Many remote administrator tools exist in the market and it is difficult to choose what you need. As you are an IT support, you need to choose the software which leads your IT skills. After you determine how much you want to manage remotely, the next step is to select the tools and supporting components you need to accomplish your remote management tasks. Our paper entails evaluating many remote control software which help you to select the remote administrator tools.

Keywords— Remote Administration Tool (RAT), LAN, WAN, control, WMI, RPC, Web.

1. INTRODUCTION necessity. Letting employees tap into the office ompanies are looking for ways to provide C local area network “LAN” from customer sites, cost-effective network access to their remote and hotels, internet cafe and airport kiosks can greatly mobile employees. For chronic problems PCs, increase business efficiency, productivity and job applications as remote assistant “remote satisfaction. But mobile empowerment has a price, administrator” can save time by giving you access measured in IT administration and network and control a remote PC via either a network or a security. dial-up connection. If your friend’s or relative’s PC is running Windows XP professional, you can As more Information Technology departments access the system remotely for free with a centralize and consolidate to reduce cost, many computer running any version of windows, remote sites are left with no on-site IT support. including Windows 95. Remote administration of computers is increasingly common because of the significant Today, providing remote and mobile workers cost benefits; many tasks can be automated, and with secure remote access to corporate networks is the administrator does not have to physically visit no longer luxury; it has become a business each computer [1]. In their whitepaper on Remote

140

Journal of Theoretical and Applied Information Technology

www.jatit.org

Systems Administration, Stephen Packard and Remote-control solutions such as Citrix Archie Andrews stated that remote systems Online’s GoToMyPC and Symantec’s administration is a reasonable, economical PCAnywhere™ are one way to provide cost- approach. Also, as networks and servers become effective network access to their remote and critical to nearly all business functions, more IT mobile employees. With the GoToMyPC departments are staffing or providing for some Corporate product for enterprises, administrators type of round-the-clock monitoring and support. can roll out and manage a remote access solution While 7 by 24 support is a great capability, it is in minutes. It is a highly secure and cost-effective limited by the ability to gain physical access to way for employees to access their computers and off-site network devices and servers when they network resources remotely. Employees simply lock up or cannot be accessed in-band. Even when access and work on their computers using any the problem occurs during business hours, the lack Web browser. This paragraph document of on-site IT staff may require an unskilled user to demonstrates that GoToMyPC has significant work with the remote IT staff to correct the advantages over Symantec’s PCAnywhere™ [2]. problem. This is not a good use of the unskilled user's time and may turn a small problem into a GoToMyPC is significantly easier to large one. implement, configure and administer than pcAnywhere™. GoToMyPC provides a cost- Remote control software provides businesses effective, easy-to-implement, fast and secure way the ability to login and access computers to enable employees to remotely access corporate- remotely. Utilizing remote control software network resources. Users find that GoToMyPC is enables personnel to transfer files or folders convenient because it works from almost quickly and easily, and communicate by instant anywhere and requires no configuration. message, text chat, or voice intercom from any PC, cell phone, wireless PDA. In contrast to PCAnywhere™, GoToMyPC is a cost-effective solution for providing secure remote This fast, reliable, easy-to-use pc remote control access to corporate computing resources without software saves you hours of running up and down extra staff requirement, loss of security or loss of stairs between computers. The remote performance. GoToMyPC is also far more administrator software allows you to take control convenient for end users because it does not of another PC on a LAN, WAN or dial-up require any client software, is accessible from any connection so you see the remote computer's Web browser and does not require prior screen on your monitor and all your mouse knowledge of the remote resource. movements and keystrokes are directly transferred to the remote machine. These softwares provide Administrators can easily deploy a remote- fast secure access to remote PC’s on Windows access solution with a minimum of effort. platforms. Additional security features can be deployed by administrators to meet existing corporate security Many remote administrator tools exist in the policies. Overall, GoToMyPC provides lower total market and it is difficult to choose what you need. cost of ownership than pcAnywhere™ [2]. As you are an IT support, you need to choose the software which leads your IT skills. After you If you have settled on Symantec’s PCAnywhere determine how much you want to manage for remote access to your corporate network, now remotely, the next step is to select the tools and is the time to reconsider. RemotelyAnywhere is a supporting components you need to accomplish more secure, cost-effective, and powerful remote your remote management tasks. administration solution that provides tools above and beyond just remote control for complete There had been existing comparison charts of administration of workstations and servers on and many remote administrator softwares that had off the LAN. been done over the Internet. We will mention the important comparison between GoToMyPC and RemotelyAnywhere deploys across your LAN PCAnywhere, and, RemotelyAnywhere and in just minutes, and provides secure remote access PCAnywhere to and administration of any machine on which it

141

Journal of Theoretical and Applied Information Technology

www.jatit.org is installed. Unlike PCAnywhere, of their parameters, when the server name is empty RemotelyAnywhere requires no special client “NULL”, the API operates on the local server, and software to be installed on your local machine. when a server name is specified, the API operates on the specified remote server. For instance, all RemotelyAnywhere is packed with robust APIs with names starting with Net such as features such as a dashboard view of system NetShareEnum() belong to this class of APIs. diagnostics, built in FTP and SSH server When used to administer a remote server, these functionality “in the Server Edition”, and superior APIs use the MSRPC protocol, “Microsoft security and auditing mechanisms for HIPAA, implementation of the DCE RPC standard” with Sarbanes Oxley and other regulatory compliance. the SMB transport. SMB is the core protocol of Windows networks and operates on both port Requiring far less configuration than 139/tcp and 445/tcp. When used as a transport for PCAnywhere, RemotelyAnywhere allows easy MSRPC, named pipes inside the IPC$ share are and secure access from a Web browser to the used as RPC services endpoints. [4] remote systems you manage [3]. Microsoft Remote Procedure Call “RPC” is an RemotelyAnywhere provides you with fast and interprocess communication “IPC” mechanism secure remote access to your corporate network. that enables data exchange and invocation of functionality residing in a different process. That Built from the ground up to seamlessly integrate process can be on the same computer, on the local with and complement existing Windows security area network “LAN”, or across the Internet. The structures, it provides easy access to the corporate Microsoft RPC mechanism uses other IPC LAN without enlarging its security perimeter. mechanisms, such as named pipes, NetBIOS, or With its easy maintenance and anytime anywhere Winsock, to establish communications between technology, RemotelyAnywhere provides a very the client and the server. With RPC, essential low total cost of ownership. program logic and related procedure code can exist on different computers, which is important The rest of this paper is organized as follows, for distributed applications. the different techniques used in remote Administration Tools, are discussed in section B. WMI “Windows Management two. An Analysis of competitive comparasion Instrumentation” between remote administrator tools is discussed in section three, followed by Conclusions and Future WMI “Windows Management Instrumentation” is Enhancements in section four. the management framework available in recent Windows systems. WMI is built on the COM “Component Object Model” infrastructure and can 2. DIFFERENT TECHNIQUES USED IN thus operate remotely, using DCOM “Distributed REMOTE ADMINISTRATION TOOLS COM” [5]. In addition, several WMI-based administration tools are available by default on The purpose of this section is to present the Windows systems to administer remote systems different methods and tools frequently used to using WMI. administer remote Windows systems, and which let you able to access a command prompt and Windows Management Instrumentation is an perform basic system administration, such as view infrastructure that enables you to access and and/or start/kill processes or services, reboot modify standards-based information about objects, machines and view system logs, observe what is such as computers, applications, and network happening on the display, and even run GUI based components, in your enterprise environment. programs all remotely, that depends on each Using WMI, you can create powerful features of these remote administrator softwares. administration applications to monitor and respond to specific events in your environment. For A. MSRPC “Win32 legacy management APIs” example, you can create applications to check The traditional method to administer remote CPU usage on your Windows Server 2003, based Windows systems is to use Win32 legacy servers and warn you when it exceeds a specified management APIs. These APIs can be easily level. Although WMI is a powerful tool for identified because they take a server name as one

142

Journal of Theoretical and Applied Information Technology

www.jatit.org building customized applications, it does require a With Remote Desktop, you can connect to your certain amount of developing time and expertise. work computer from home and access all of your programs, files, and network resources as though Windows Management Instrumentation you were actually sitting in front of your computer Command-line “WMIC” provides a simplified at work. interface to WMI. By using WMIC, you can access WMI based information using the D. CLI-oriented tools command line or scripts. You can use WMIC from any computer where WMIC is enabled to manage CLI “Command Line” remote administration tools any remote computer. WMIC does not have to be are sometimes needed, for instance to execute non- available on the remote computer. interactively system administration scripts [6].

Currently, testers of the Windows Management PsExec is a convenient tool for Windows systems Instrumentation “WMI” conduct tests through a administrators because it allows to execute proprietary GUI interface, which does not allow processes on a remote system, provided the server for negative testing or the logging of events and service is available “TCP ports 445 or 139” and methods. that you have local administrator credentials on the remote system [7]. C. GUI-oriented tools build in windows PsExec first copies its executable, psexesvc.exe, Many Windows system administrators tend to use contained in the psexec.exe binary, using SMB, graphical remote administration tools that allow under %systemroot%\System32\, installs the access to Windows GUI. service and starts it. These steps require administrator credentials. Recent Windows systems “Windows 2000, Windows XP, Windows Server 2003” natively If you are logged on with local credentials that support Terminal Services, the feature of also correspond to local administrator credentials, Windows NT that allow multiple concurrent with a domain administrator account or with an interactive logon sessions. The network protocol account with username and password identical to a used by Terminal Services is RDP, Remote local administrator account on the remote system, Desktop Protocol, and operates by default on TCP additional credentials are not needed. port 3389. Rcmd is a Windows NT 4.0 Resource Kit tool Terminal Services rely on Windows authentication composed of a Windows service and a command- to authenticate users establishing remote sessions. line client that supports remote process execution. In addition, applicative permissions are supported The Rcmd service opens a named pipe, by Terminal Services to restrict the category of \pipe\rcmdsvc. The Rcmd client establishes an users allowed to establish Terminal Services SMB session to the IPC$ share, authenticated with sessions, Permissions tab in the Properties of the an account that needs to have the RDP-Tcp transport in Terminal Services SeInteractiveLogonRight logon right "Allow log Configuration MMC snapin. on locally".

Remote Desktop, included with Windows XP E. Web based tools Professional, enables you to connect to your computer across the Internet from virtually any One of the major issues confronting information computer, Pocket PC, or Smartphone. Once systems “IS” managers today is how to provide connected, Remote Desktop gives you mouse and secure access to corporate IS resources to people keyboard control over your computer while who are physically located outside of the corporate showing you everything that is happening on the network. In today's increasingly connected society, screen. With Remote Desktop, you can leave your traveling salespeople, telecommuters and staff computer at the office without losing access to working extra hours all need real-time access to your files, applications, and e-mail. Your sales resources on corporate networks. force will be able to access the latest pricing sheet from on the road by using Remote Desktop in For security reasons, these resources, such as Windows XP Professional. databases, sales tools and email are usually protected by firewalls so that users outside the

143

Journal of Theoretical and Applied Information Technology

www.jatit.org corporation cannot access them. Companies are F. Features looking for ways to provide cost-effective network access to their remote and mobile employees. Figure 1 represents the availability of these Many Remote-control solutions are one way to features “Main Features” in the available products provide this access. in the market. These features are Support Different Resolutions, Support Different Color Depth, The Web based remote administration tools like Remote Clipboard, Simultaneous Multi-Protocol, GoToMyPC is a hosted service that enables secure Simultaneous Control & Client, Multiple Controls, browser-based access to any Internet-connected View Multiple Clients, Printer Redirection, Microsoft Windows-based PC. Features include a Scaleable Windows Record & Replay Session, screen-sharing Viewer, drag-and-drop File Watch, share, Control a Client PC, Send Ctl-Alt- Transfer, Remote Printing, Guest Invite and Chat. Del, Remote Reboot, Blank Client Screen and Corporate administrators have access to extensive Web Browser Integration. management and reporting tools that enable

central control over these remote-access services. WiSSH

H S

While choosing a Windows remote administration WinS

omput

tool, the following characteristics have to be C er

considered the TCP ports required to use the r

Virtual Network Network Virtual

ce Explo ce

remote administration feature the supported pe

mot em

authentication mechanisms, system authentication R

nyw

implemented by Windows, application level yA el

mot em

ng R i

authentication only. r

op Sha op

eskt

s e e

mot em

R rol To rol

er t emote Co emote

3. COMPARISON AND ANALYSIS R

Remote Comp Remote ng

nyt

In this paragraph, we mention the availability of ot

o t

istra

n features in each remote administrator tools. In i

ote ad ote

re addition of chart on each group of features, it will Re

present the strengths of these remote administrator Anywhe PC

ge a

tools. These charts help the IT to choose the an

NetSupport M NetSupport

con

remote administrator tool that leads their e

emot

p p

e Softwares et

professional skills. N

bserv

Features ET

n i

et We did this experiment for a couple of reasons. N

First, it seemed like a great academic exercise. 2

t Control Control t

There’s a certain challenge that comes from C yP

M C

administering your organization’s web server or I

Primary Domain Controller via a small handheld GoverLA

oMyP computer. However, there’s also the allure of T

being truly able to administer servers remotely ssi

op Profe op

without having to carry around a laptop. eskt

e e

bi r

emot

op R

eskt CO CO

E t

i r

tho

The advantage of such a model, should it prove u A

eskt D

successful, is an ability to carry a pocket-sized e

device and yet have full remote terminal

l I l

o DameWare NT Utiliti NT DameWare

capabilities. You’d not have to leave other Contr

o r

situations for some emergencies. Instead use your t

ace Con ace

n A

handheld device to solve the problem over a phone n AdmWi

8 6 4 2 0 16 14 12 10 line, Ethernet, or wireless link. The usefulness of vailabilities A Features this becomes very apparent when you’re at some social event or in a meeting. Figure 1 - Main features

144

Journal of Theoretical and Applied Information Technology

www.jatit.org

G. File Transfer H. Misc Feature Figure 2 represents the availability of these Figure 3 represents the availability of these features “File Transfer” in the available products features “Misc Features” in the available products mentioned in the market. These features are One to mentioned in the market. These features are One File Transfer, Synchronize Drives and Telnet, Remote Deployment of Software, Group Directories, Support long file names, File Connect at Startup, View Multiple Clients Compression and Launch Remote Applications. Simultaneously, Chat, Scripting and Silent

Installation.

iSS

H iSSH Wi

tin inSSH Wi

tin or l

C Virtual Network Compu Network Virtual

rk rk

r o Service Exp Service

w e

l Ne l

ce Explor ce

Vir

rvi RemoteScop

Se e

re er

Any

el emoteScop t

re R

RemotelyAnywhe ng

l To l

a o

Remote Desktop Shar Desktop Remote

r ote Contr ote

t m

u ls

te Desktop te

rol To rol t em

mo o

C g

i e

emo p

e R t

Remote Com Remote

stra i hi

e e

e o

her

Remote admin Remote R

PC Any PC

n i

e a

e e

emo

PC Anyw PC etSupport Mana etSupport

tro

con

t g

Rem

e Softwares Man

erv

tOp

s e

tro N etSup

in t

e Software

Remot

Net

r p

etO

Obse N

File Transfert File T

ol ol

Con

t Net

etm yP

N M

IC 2

Misc Feature

rol rol

Con

rLA

v Net

GoTo

oe LA Gover

C s

rofe

P er

ToMyP

op op

t o

Desktop Orbit Desktop

t R i

hor CO CO t

ssi

top

it Des

p Pro p

tilit

U top Or top

te Deskto te

esk

e NT NT e

r D

T y a

ol I ol

r ori

n me t

Co D

p EMCO Re EMCO

eskto

D o

T Utiliti T

Anyplace Contr Anyplace

l I l

dmWin

6 5 4 3 2 1 0 ameWare ameWare

Contr

s vailabilitie A Features a

ypl

An W

Adm

8 7 6 5 4 3 2 1 0

s Figure 2 - File Transfer Features Availabilitie Features

145

Journal of Theoretical and Applied Information Technology

www.jatit.org

Figure 3 - Misc Features Figure 4 - Security Features

I. Security J. Protocol Support Figure 4 represents the availability of these The Figure 5 represents the availability of these features “Security” in the available products features “Protocol Support” in the available mentioned in the market. These features are products mentioned in the market. These features Password Encryption, Dial Back, Use Windows are IPX/SPX, NetBIOS, TCP/IP and NetBEUI. 2000 Profiles, User Acknowledgement at Client, Password Protection at Client/Control, DES

Encryption, Use NT Profiles, and Audit Log.

SSH

WiSSH

H D

nSS

nSSH Wi i

Computin

e rk rk k C k

or l

w t

e N

l Netwo l

rtua r e

o i

S V Vi

eSc Service Explorer Service

Scope

m e t

o e

e e

her

e g t

RemotelyAnywher

emo

Sharin

Remote Deskto Remote o

rol T rol

To nt

e Co

ote ote

Remote Desktop Remote mput

g mputer ote ote

Remote Contro Remote

hin

Remote

or t

a Remote Anythin Remote

te An te

str

i o

min

e d

Rem

inistrator

Remote a Remote

e ad e

t PC Anywher PC

emo a

R a

PC Anywhere PC rt M rt er

ana

tSupp

c e

te o

rol t

Remo co

etSupp

te te

N Softwares tOp

TObserve o

m Ne N

p eeting

O Softwares

2 Ne N

NETObserve

trol trol

Security n et

tme

Ne Ne

rol ICMyP t

et Con et N

Protocol Support Protocol

GoverLA MyPC

I C

GoToMyP

ver

o yPC

M s

rofe oTo

p Orbite

to p

siona

e D e

Deskt

horit

Pro

p p

MCO Re MCO

liti

E i D

y Ut

r T mote Deskto mote

Desktop Orbiter Desktop e N T

R e e l

ntro Wa

p Autho p

o e

EMCO

eskt l

o t

t U

o T T

re re

place C place

mWi

ame

Control IT Control

ro 4 3 2 1 0

e 4.5 3.5 2.5 1.5 0.5

ypl

An s Availabilitie Features

AdmWin 9 8 7 6 5 4 3 2 1 0 Features Availabilities Features

146

Journal of Theoretical and Applied Information Technology

www.jatit.org

Figure 5 - Protocol Support Figure 6 - PlatForm Support

K. Platform Support L. Connectivity The Figure 6 represents the availability of these Figure 7 represents the availability of these features “Platform Support” in the available features “Connectivity” in the available products products mentioned in the market. These features mentioned in the market. These features are are Windows 95, Windows 98, Windows "ME", Analogue Modem, ISDN, WAN, LAN and

Windows 2000/XP, NT 3.X, NT 4.00, Linux. Wireless IRDA.

WiSS iSS

inSS

W inSS

mputi

mpu

er k k

Networ

e Explor e a

Virtua

c i

rtu

v i

S e rvice Explo rvice

op S

co o

r emoteS

whe

ny er

lyAnywh

ng te

RemotelyA

Remo g

ktop Sha ktop

sktop Sharin sktop

o e To

m ol

s l

ntr Re

Remote D Remote

ontrol To ontrol er

ut C

Remote Remote o r

Comp

Rem

e t

Compute

Remote

mot

s i Remote Anythin Remote

n r

dmi

e o

er m

te admi te

wh Re

Any

Remo

ywh

n PC

g PC A PC

port Mana port

r Su

ntr

e e

R te contr te

t Softwares

e Softwares

NetOp Rem NetOp

NETOb

NETObse i t

mee t

Ne Connectivity

tmeeting

N 2

rol

Platform Support t

Con

Net Control Control Net P

CMy

yPC

ICM

rLA

LA Gov

Go C

C ToMy

Go M

sio

e f

p p

k r

ite

Des

e Professio Or

p p

t op

bite

r sk Remo

o r

mote Desk mote

skt

EMCO EMCO

De Re

p Autho p

EMCO

s u s

p i

il o

Deskt

tie i

NT Util NT

DameWare NT NT DameWare a

Contro l I l

DameW

o Contro

r t

e Con e l

ac tro l

n p

Any

Anypla AdmWi

Adm

7 6 5 4 3 2 1 0 8 7 6 5 4 3 2 1 0

Features Availabilities Features

s Availabilitie Features

147

Journal of Theoretical and Applied Information Technology

www.jatit.org

Figure 7 - Connectivity Support An evaluation is being built on existing remote administrator tools of the availability of features 4. CONCLUSION and is expected to be one of the important Using remote administrator tools for graphical evaluations used by major high-energy research. remote administration of computers running This evaluation let customers choose their need of Windows can greatly reduce the administrative remote administrator tools carefully. overhead in any Windows 2000 Server or windows workstation environment. Administrators REFERENCES can access the servers from anywhere, be it inside the computer room or from halfway around the [1] CERT, Configure computers for secure remote world over a WAN, VPN, or dial-up connection. administration, 2000, URL: They can start time-consuming batch http://www.cert.org/security- administrative jobs (for example, tape backups), improvement/practices/p073.html. disconnect, and dial-in to the corporate network at [2] 1997-2004 Citrix Online, a division of Citrix a later time to check the progress. Systems, Inc. All, Citrix Online Division 5385 Server application and operating system upgrades Hollister Avenue Santa Barbara, CA 93111, can be completed remotely, as well tasks that are 1997-2006. URL: https://www.gotomypc.com not usually possible unless the administrator is /ourTechnology.tmpl? sitting at the console, such as domain controller SessionInfo=12759838:5F8BC3C78C05104 promotion/demotion and disk defragmentation. [3] RemotelyAnywhere™ and pcAnywhere™: a Server file system tasks such as copying large files Comparison 3am Labs, 2005. and virus scanning are much more efficient when URL: performed within a remote tools session, rather http://www.remotelyanywhere.com/RA_vs_pc than using utilities that are executed on a PC Anywhere _v6.pdf client. [4] Hervé Schauer Consultants, Jean-Baptiste Administration tasks are quicker and more Marchand, Windows network services intuitive than using command line utilities, internals, 2003, 2004, 2005, 2006. although it is still possible to open up a command URL: shell. Administrators can also fully administer http://www.hsc.fr/ressources/articles/win_net_srv/ Windows 2000 Servers using non-Windows 2000 clients. [5] Microsoft Technet's Script Center, 2006. URL: Remote administrator tool is an affordable tool http://www.microsoft.com/technet/scriptcenter/ that any small business owner can purchase without having to consult his accountant. [6] Mark Russinovich, The PsExec utility, part of Companies offer very flexible licensing policies Sysinternal's PsTools, 1999-2006. URL: for Remote administrator tool that cover multiple http://www.sysinternals.com/ntw2k/freeware/p computers at minimal expense. stools.shtml.

Remote administrator tool has no special hardware [7] Mark Russinovich, PsExec supports several requirements. Even if your old home computer is options, 1999-2006. URL: what you use for running your business, it’s fast http://www.sysinternals.com/ntw2k/freeware/ enough for Remote administrator tool. If the psexec.shtml computer runs Windows, Remote administrator tool will run on it, and it will run faster than any other remote control software you can buy.

148