By Woody Leonhard
The sneaky “drive-by download” known as Sinowal has been, uh, credited with stealing more than 500,000 bank-account passwords, credit-card numbers, and other sensitive financial information.
This exploit has foiled antivirus software manufacturers time and again over the years, and it provides us in real time a look at the future of Windows infections.
Imagine a very clever keylogger sitting on your system, watching unobtrusively as you type, kicking in and recording your keystrokes only when you visit one of 2,700 sensitive sites. The list is controlled by the malware’s creators and includes many of the world’s most popular banking and investment services.
That’s Sinowal, a super-Trojan that uses a technique called HTML injection to put ersatz information on your browser’s screen. The bad info prompts you to type an account number and/or a password. Of course, Sinowal gathers all the information and sends it back home — over a fancy, secure, encrypted connection, no less.
Washington Post journalist Brian Krebs wrote the definitive overview of Sinowal’s criminal tendencies in his Oct. 31, 2008, column titled “Virtual Heist Nets 500,000+ Bank, Credit Accounts” — a headline that’s hard to ignore. Krebs cites a detailed analysis by RSA’s FraudAction Research Lab: “One Sinowal Trojan + One Gang = Hundreds of Thousands of Compromised Accounts.”