1 Trojan + 3 years = 500,000 online financial accounts
RSA FraudAction Research Lab has discovered log-in information for about 300,000 online bank accounts and 250,000 credit and debit card accounts that have been gathered by a cybercrime gang over the past three years using the Sinowal Trojan.
"This may be one of the most pervasive and advanced pieces of crimeware ever created by fraudsters," according to a blog entry posted Friday from RSA, EMC's security unit.
The Sinowal Trojan infects computers without the owner knowing it by surrepticiously planting itself onto the computer while the owner is Web surfing in an attack dubbed a "drive-by download."
The malicious code is typically hidden on an unfamiliar Web site, often related to porn or gambling, but can also be found lurking on legitimate Web sites, says Sean Brady, manager of identity protection at RSA.
The Trojan is programmed to execute when the victim visits a particular banking or financial Web site; it is triggered by more than 2,700 specific URLs, according to RSA. The malware then inserts additional fields into the victim's browser prompting the victim to type in information such as PIN and Social Security number, which the Web site itself does not ask for.
This chart shows the rate at which the Sinowal Trojan has been compromising online bank accounts since early 2006.
(Credit: RSA)The company has alerted law enforcement and has provided the compromised account information to the financial institutions involved, Sean Brady, manager of identity protection at RSA, said in an interview on Thursday.
"This could be a wake up call for institutions and end users who have ignored the fact that Trojans are out there," he said.
The Sinowal Trojan has had ties to the identity theft organization known as Russian Business Network, but the hosting facilities of the malware appear to no longer be connected to that group, according to RSA.
"Only rarely do we come across crimeware that has been continually stealing and collecting personal information and payment card data, and compromising bank accounts as far back as 2006," the blog post says. "And in addition to its longevity, Sinowal has also been evolving at a dramatic pace - its rate of attacks spiked upwards from March through September of this year."
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
Steven Sprague
Wave Systems Corp.
It's a nice idea, but the real world practicality just isn't there yet.
There is no such thing as a 100% secure system.
If a trojan gets onto a computer, it is capable of getting any information from any device wired to it.
The only way to prevent something like this would be a embedded OS that takes control over the OS below whenever something tries to access the TPM hardware, and whether to allow or disallow.
No chance in that happening any time soon.
Anyway, the way this trojan works, I don't think it'll help. With a slight mod it could just serve up another page that looks almost like your bank's website and just do a standard phishing attack. Even though your bank may not normally ask for account information or pin number the fake site may anyway. Many people will still fall for it. Just like when your ISP says we will never ask for your password, but as soon as people get a fake email asking for it they reply back with their password. It's just stupid human nature.
Now it's another form a security. Yes it would stop some attacks, but people will never use it because people will lose the ability to log in from any machine. Is it dumb for them to be logging into their bank account from just any old machine? You betcha! Will stupid people complain anyway if they can't do that? You betcha! If people lose convenience they will not use it. The best we could probably ever do is use smartcards that plug into the computers USB port to auth websites and a USB port on ATM machines and cash registers. It's different, but it's similar enough to what people already do. They could be authenticating with public/private key technology where the private key never has to leave their handheld device.
Now, maybe I just don't get TPM, but that's the problem. Apparently TPM isn't very intuitive either let alone it's other flaws. Like when it started out as another failed DRM technology to restrict what I can and can't do with my own machine. Not so I could trust it, but so big companies could trust my machine to take orders from them instead of me in case I'm pirating their stuff. I really don't want anything to do with that even if it's simply because of how it got started in the first place.
a simple concept actually, it just made an inventory of the programs on your computer together with a 32-bit CRC (digital signature ) for each program. That way you could check to find if you had anything new, anything missing, anything changed.
hunting through your computer's terabyte hard drive for something you have no description of doesn't work. the days of anything goes cowboy programming have go to come to an end.
authorized programming only must becopme the order of the day.
Are you suggesting only certain people should be allowed to program? What is authorized programming? What is I've never heard of such a thing.
If only certain people could program you can say goodbye to Linux(which is more secure than Windows, yet programmed by anyone that wants to contribute), Opera, Firefox, Open Office, MySpace, Facebook, the GIMP, Chrome, YouTube, InkScape, Pidgin, Trillian, and maybe even Photoshop, Adobe, or Google and the list never ends. I mean who's to say what won't be authorized? Sure, they're all big names now, but when they were starting out would they have been given permission? Will their next upgrade be authorized?
To do what you suggest you'd have to shut down every blog, message board, MySpace+Facebook profile and social app, and any site that has user generated content because people communicate more with HTML and JavaScript then they do English now. Even changing your MySpace profile requires you to enter codes. Also, look at the game consoles that have been hacked to run Linux. Not only is what you suggest not going to work, it's not even possible.
Yeah, let's also outlaw unauthorized speech while we are at it, that might eliminate con artists that use old fashioned real life social engineering.
The only thing right now that is working on the Mac's favor is that these criminal rings are trying to cast the widest net with the least work, so expect to see trojans on the Mac as Apple's market share increases.
In a sense, the question should be "Am I susceptible to a trojan" and with the criminal rings getting more apt at social engineering, we may all need an "malware profile" update!
So, in short, OS X is NOT and HAS NOT been susceptible to this trojan, but very well COULD be susceptible if the programmers modify this trojan to affect OS X. As far as we know, the criminals have not done so, correct? As far as we know, this trojan does not exist in any form that affects OS X.
I Ran Windows for many years before switching to a Mac five years ago so I carried my paranoia over the OS X. I run a very good firewall, use a router and also run ClamAV for OS X. That latter is more to make sure that I do not pass anything along to my Windows using friends, but it may become a necessary component for OS X as well in the future.
Just remember, there is no such thing as a completely secure OS. Any idiot will find a way around even the best defenses. :-)
Sinowal Trojan works by inserting itself as a service in Windows and comes in the form of a DLL. So it is OS and binary specific and won't run on a Mac.
It will, however, infect a Windows virtual machine, such as Parallels or VMWare Fusion, running on an Intel Mac and Mac users can be inadvertently spreading the email-vectored version of this trojan if they forward an infected message or page to someone.
We should always be diligent but however, on the flip side, there is a fine line between diligence and paranoia.
Anyone can find the biggest security risk, just look in the mirror.
LOL
The architecture of OSX protect you far more than AV software. That is why OSX doesn't require AV at this time. At some point, someone might get around the architecture, which will require AV software at that point. But 8 years of not needing it and counting...
AV software is always behind the curve so it will not come close to 100% accuracy. All AV software is rife with false-postives and false-negatives(the virus known as Symantec AV is "good" at this).
***If you need to question why I called Symantec a virus you don't know enough about the topic to comment. You can disagree with it, but you need to know why it is categorized as such.
@Seaspray0: A/V solutions are reactive - not proactive, which means it won't help you if you were compromised before your A/V signature or heuristics had been updated. By then it'd be too late.
The inherent security of OSX makes it highly unlikely (not bulletproof, just extremely unlikely) that you would have to bother with this article if you use a Mac and OSX to do your banking.
Now, if you use Windows, you really should check, and may well have cause to panic (esp. if you have more than one user on your machine/s ).
/P
/P
There are plenty of porn and gambling Web sites that are operated by legitimate, publicly listed corporations and plenty of "legitimate" Web sites that aren't.
Statements like this do not help the real world users out there that might think that just because they don't visit porn or gambling sites that they are safe from trojans or other forms of malware.
They also often fail to inform users that these criminal groups can and have inserted malicious code into "legitimate" Web sites without their owners knowing it. Just like how a computer can be compromised by malware or virus, Web sites, in a manner of speaking, can be infected and used as a vector.
Any site could be used to transmit malware.
Why?
Because I work on a reasonably secure machine(Linux).
It is still software, even if it "targets" hardware(AKA firmware and drivers), it is still OS specific.
Or it could be that the Mac OS is inherently very difficult to write malware for that will infect and spread invisibly. So difficult in fact that so far no one has managed to do it.
Given my argument and the history of malware, I think the 2nd choice is more likely.
I make alot of money removing virii and recovering data from Mac's. Help my job security by not protecting yourself!
As for the rootkits...the answers are out there...go beyond the blue.
Anyways, so far, no one has made a virus, worm, or trojan for Linux or Mac that is more effective than sending people an email saying "To improve the performance of your computer, type rm -rf / at the command line". You'll probably snag more idiots that way.
Interesting. Would you be willing to share the names of the virii you have removed from Macs? I wasn't aware of any in circulation.
Thanks,
DG
Get off the internet, and start using a typewriter :)
- by comment1 November 3, 2008 7:23 AM PST
- phrelin,
- Like this Reply to this comment
-
(37 Comments)I would suggest you go to the bank, as I do. Security, then, becomes the the bank's business.
If you have watched the news in times past, there was a show which explained how the US gov't was intercepting messages between banks and changing data to prevent criminals from using interbank transfers. Having your paper receipt reduces your hassles. Yes, it's more time consuming, but it reduces risk...Remember the US tapped the trans-Atlantic cable going into Russia? For ten years we laughed. :)