Don’t be a victim of Sinowal, the super-Trojan

Woody leonhard By Woody Leonhard

The sneaky “drive-by download” known as Sinowal has been, uh, credited with stealing more than 500,000 bank-account passwords, credit-card numbers, and other sensitive financial information.

This exploit has foiled antivirus software manufacturers time and again over the years, and it provides us in real time a look at the future of Windows infections.

Imagine a very clever keylogger sitting on your system, watching unobtrusively as you type, kicking in and recording your keystrokes only when you visit one of 2,700 sensitive sites. The list is controlled by the malware’s creators and includes many of the world’s most popular banking and investment services.

That’s Sinowal, a super-Trojan that uses a technique called HTML injection to put ersatz information on your browser’s screen. The bad info prompts you to type an account number and/or a password. Of course, Sinowal gathers all the information and sends it back home — over a fancy, secure, encrypted connection, no less.

Washington Post journalist Brian Krebs wrote the definitive overview of Sinowal’s criminal tendencies in his Oct. 31, 2008, column titled “Virtual Heist Nets 500,000+ Bank, Credit Accounts” — a headline that’s hard to ignore. Krebs cites a detailed analysis by RSA’s FraudAction Research Lab: “One Sinowal Trojan + One Gang = Hundreds of Thousands of Compromised Accounts.”

This article is part of our premium content. Join Now.

Already a paid subscriber? Click here to login.



Woody Leonhard

About Woody Leonhard

Woody Leonhard is a Windows Secrets senior editor and a senior contributing editor at InfoWorld. His latest book, the comprehensive 1,080-page Windows 8 All-In-One For Dummies, delves into all the Win8 nooks and crannies. His many writings tell it like it is — whether Microsoft likes it or not.