The Sinowal Trojan Steals You Blind

This morning, home sick, reading /. I find this story about the Sinowal Trojan.

Evidently, starting in 2006, this Trojan has been stealing sensitive data from thousands of Internet users across the globe, except for those in Russia. Seems even the Russian mob has a heart.

This all raises a question I've often asked myself. I've been managing enterprise environments for years now, using a variety of methods to protect the sheep, in hopes that the worst is avoided; a full network infection.

It's happened to me once, when I worked for the Racine Art Museum. I'd been hired to oversee the IT side of a new museum we were raising capitol for. The environment was rather new at the time; NT Back Office server, 2000 clients, Trend AV suite.

Unfortunately, as in some environments like this, there are applications that require elevated privileges to run. I suspect that this may have had something to do with the rapid spread of this virus. The signs were odd; in each network share on the server, .msg files started to mysteriously appear. A cursory search on the web revealed that this was a strain of virii that spread itself in this manner, eventually filling up all volumes on all systems and bringing the network to a screeching halt. I was able to quickly find a fix and apply it, saving us from disaster.

Which brings me to the question that I've been wondering...

Just how many more of these types of virii exist, and have not been detected? If this one was able to survive for this period of time before discovery, I must conclude that there are more out there, undiscovered, collecting data, sending it to some Russian mobster, so they can go on with their mobbing ways.

I'm not snubbing the AV companies by any stretch. They have all they can do to keep up with the virii Jones' next door. What frightens me is that while technology is a wonderful thing, we also grow increasingly reliant on it, and the AV companies to protect us from the bad guys. Can we expect them to do a satisfactory job for $59.99?

With that growing reliance, we will also see a parallel in the growth of cyber crime. I already stay away from questionable websites, don't open mail from unknown senders, or run software from unknown sources. I have a popular AV package and Spyware protection solution running on my systems. This doesn't gaurantee my safety, and I certainly don't like the idea of some idiot obtaining my SSN, opening an account at Best Buy, and running up several thousand dollars of the latest-and-greatest HD/Gaming system bundle. What measures will we need to take to secure our sensitive data beyond AV/Spyware/Trojan protection?

Surely, someone will develop a system that will cross check our Credit Card number with a PSK embedded in our head some day.... Until then, I'll cross my fingers and toes.