Homestead mailing list

[EarthNSky <erthnsky AT bellsouth.net>]

For some reason, Lynda cannot seem to post directly to the list, so this 
is a forward.

-------- Original Message --------
Subject:        Privacy World's November 2008 NewsletterIssue 1Nov
Date:   Sun, 2 Nov 2008 10:06:23 -0800
From:   Lynda <lurine AT softcom.net>
To:     EarthNSky <erthnsky AT bellsouth.net>




Privacy World - The WORLD'S SHREWDEST PRIVACY NEWSLETTER

Undetectable data-stealing trojan nabs 500,000 virtual wallets

A well-organized crime gang has stolen credentials for more than a
half-million financial accounts in less than three years using a
sophisticated trojan that remains undetectable to the vast majority of
its victims, a report published Friday warns.

The haul of bank, credit, and debit card account numbers stolen by the
Sinowal trojan is among the largest ever discovered. It was unearthed
by researchers at RSA's FraudAction Research Lab. They say the
program, which is also known as Torpig and Mebroot, has been operating
non-stop for almost three years, an unusually long time in the
fly-by-night world of cybercrime.

"Only rarely do we come across crimeware that has been continually
stealing and collecting personal information and payment card data,
and compromising bank accounts as far back as 2006," RSA researchers
wrote.

What's more, Sinowal has only managed to become more productive over
time. In the past six months, it has compromised more than 100,000
accounts. Since February, the number of variants has spiked, from
fewer than 25 per month to more than 70, according to RSA. The
increase helps the malware evade detection by anti-virus programs.

In all, the trojan has infected at least 300,000 Windows machines and
stolen 270,000 online banking account numbers and 240,000 credit and
debit credentials.

Sinowal is impressive for other reasons as well.  Unlike many trojans,
it doesn't rely on tricking the end user into clicking on a link or
file to get installed. Rather, it spreads silently via websites that
prey on unpatched vulnerabilities in the Windows operating system or
in third-party applications, such as Adobe Flash and Apple's QuickTime
media player.

"This particular trojan can get installed without even awareness of
the end-user that they have agreed to anything or that anything has
been installed," Sean Brady, manager of identity protection at RSA,
said in an interview.

It then hides itself on a computer's master boot record, making the
infection extremely difficult to find. About the only remedy for
victims fortunate enough to learn they are contaminated is to reformat
their hard drive and reinstall their operating system.

Brady said RSA has shared the data it discovered with affected banks
in the hopes they will notify customers who are infected.

Sinowal sits dormant on a machine until a user points a browser at the
website of a bank or other financial institution. Then an HTML
injection engine adds fields to the website's login page that prompt
victims to enter social security numbers, passwords, and other
credentials. Once entered, the information is transmitted to a server
under the control of the malware authors. The injection mechanism is
triggered by more than 2,700 different web addresses.

Little is known about the group responsible for Sinowal, but at least
one clue suggests the group has ties to Russia: While the trojan
targets institutions in dozens of countries in North America, Europe
and Asia, none were located in Russia.

Until our next issue, stay cool and remain low profile!

Privacy World


For in reason, all government without the consent of the governed is the
very definition of slavery. -Jonathan Swift, satirist (1667-1745)



--
"Fear is the path to the Dark Side. Fear leads to anger. Anger leads to 
hate. Hate leads to suffering."        Yoda

No virus found in this incoming message.
Checked by AVG - http://www.avg.com 
Version: 8.0.175 / Virus Database: 270.8.5/1761 - Release Date: 11/1/2008 
7:56 PM