They will be hunted, they will be traced, they will be caught. They already know this. It's only a matter of time. Enjoy the Ferrari while you can guys. The brightest burn the shortest.
Prevention/detection? Checksums I guess. Behaviour issues on file stores; massive numbers of files being accessed at once should be an alert for the OS to stop and warn. As for the database key replacement... can't think of a way to handle that, unless the engine keeps a secondary repository and if the key changes, it flags up and stops processing.
Biting the hand that feeds IT
