RSA, EMC's security division, reported last week that its researchers found a treasure trove of financial data stolen by the Sinowal Trojan. Here is more background on the Trojan and RSA's findings.After eWEEK published the initial story last week about RSA
finding a cache of data stolen by the Sinowal
Trojan, several readers requested additional information.
Here is a little more background on the Trojan, RSA's
findings and links
to more information. Also identified as Torpig and Mebroot, Sinowal has
rootkit elements that infect the Master Boot Record and allow it to hide.
The Trojan has many variants, some of which are detectable by traditional
anti-virus companies such as Symantec and McAfee. However, the number of
variants and their low distribution volumes make it difficult for security
vendors to keep track of the latest variants.
For the past six months, RSA has observed
at least 60 variants of the Trojan each month. A recent variant, submitted Oct.
21 to Virustotal, was detected by less than 30 percent of the 35 security
vendors given the file.
RSA investigators found nearly 300,000
online banking account credentials, as well as a roughly equal number of credit
and debit account numbers and associated personal information. The cache of
data represents bounty collected from Sinowals victims as far back as February
2006.
An analysis of the Sinowal Trojan itself identified a road map leading to
the location commonly known as the drop zone, a point where Trojans send their
stolen information, said Sean Brady, manager of identity protection at RSA,
EMCs security division. The drop zone
itself was publicly exposed to the Internet, where the RSA
FraudAction Research Lab was able to address the database and recover the
credentials.
Once downloaded, Sinowal uses an HTML injection feature to inject new Web
pages or information fields into the victims Web browser. When a user tries to
visit one of 2,700 financial service domains, the fake site pops up instead and
prompts the user for log-in or financial information. Detected variants target
Windows 2000, XP, Vista and Windows Server 2003,
according to various security vendors.
The best initial line of defense is to maintain an up-to-date anti-virus
solution on your PC and use it to run a full system scan, Brady advised.
However, the Sinowal Trojan can be challenging to detect once it is installed
locally, since it uses rootkit techniques designed to evade detection.
Brady recommended that users keep an eye out for changes to Web sites they
normally visit. For example, a prompt for personal information or for the user
to download files in order to view a video could be a tip-off.
Knowing that their financial institutions should never randomly request
personal information online, such as log-in credentials or Social Security
numbers, [can be a defense], he said.
For those looking for a list of financial institutions, RSA
has chosen not to publicize them, citing privacy and security. However, RSA
officials said they have reached out to affected institutions as well as
law enforcement.
| | Reader Comments: Keeping an Eye Out for the Sinowal Trojan | | >>> Post your comment now!
| | | | | | | | Secure bankingOne way to improve your on-line banking security is to choose a bank that will provide two-factor authentication. E*Trade, for example, will supply a... Posted At: 11-08-08 By: A Hewitt | | | | | | How many years ago was that?I have used openSuSE for for years, and it never 'required' me to use a command line. And there are places you need to use command line in Windows... Posted At: 11-07-08 By: John Bowling | | | | | | RE: Multifactor AuthenticationWhile it is a start to better FI web security, it is also flawed. I believe that at a Black Hat conference shortly after the FFIEC deadline for... Posted At: 11-06-08 By: Graph-X | | | | | | MoveI moved to UBUNTU 4 years ago no more problems,I'm not very literate with computers so someone set up my system. It was much better than windows 98... Posted At: 11-05-08 By: Rod | | | | | | A user comment on this articleI've never had to rebuild my Windows kernel. I've never had to resort to command-line to install applications or drivers. So your easier-to-use... Posted At: 11-05-08 By: Rick | | | | | | One obvious solutionThe obvious solution to this (and countless other) threats is to quit using products, or at least operative systems (i.e. Windows), from... Posted At: 11-05-08 By: Anonymous | | | | | | >>> Post your comment now! | | | | | |
|
 |