CNN reported today that Sophos was warning new strains of RINBOT, also known as DELBOT, could be stealthily be infecting business networks worldwide.
What can this new version do?
According to Sophos it can:
* Allow others to access the computer and network systems
* Install itself in the Registry
* Exploit system or software vulnerabilities
* Enable remote access to the business networks
In the CNN article Graham Cluley from Sophos indicates,
“Cluley said this strain appears to be hitting MS SQL servers. It looks for networks that run the Windows operating system, including Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT and Windows XP. It then spreads through the network by manipulating “weak” spots such as simple passwords.
Once it’s in, Cluley said the virus quickly spreads and takes over many computers with the intention of turning the network into a BOTNET, or a “zombie” network.
“Without you knowing it, hackers will use your computer for a variety of purposes like sending out spam, or distributing denial of service, or even blackmailing other Web sites. There was a case where hackers blackmailed a gambling site and said they would bring down the site for a few days unless they were paid thousands of dollars” Cluley said.
Because of how it works, Cluley warned that the virus is not geographically limited.
“It’s very stealthy and insidious and works without you knowing it,” he said.”
One company that has reportedly been infected with RINBOT is Time Warner.
If you are not defending against this type of malware, and others like it, these illicit activities performed right under your nose on your own business network may be putting not only your network, but also the personally identifiable information (PII) for which you are responsible, at risk.
Privacy folks, please work closely with your information security folks so that you know how these types of malware put PII at risk, and ensure appropriate protections are applied.
Malware protection is just one more consideration to make when doing your risk analysis to determine whether or not to encrypt PII in storage. If your network is vulnerable to such malware that can copy PII files from your network, then encrypting the PII can help make such exploits less damaging, at least with regard to privacy breach and legal compliance.
Tags: awareness and training, botnet, denial of service, Information Security, IT compliance, malware, policies and procedures, privacy, privacy breach, risk management, virus