Malware writers go patent-snatching in Peru

Powered by SC Magazine
 

CAD drawings slurped via email.

Researchers have uncovered a worm that stole "tens of thousands" of blueprints and product designs from computers in Peru.

Medrea is an information-stealing worm that transferred AutoCAD drawings by email to accounts based in China, ESET researchers said.

The worm, dubbed ACAD/Medre.A, was discovered in February, but recently increased in activity, according senior research fellow toRighard Zwienenberg.

AutoCAD was popular among engineers and architects. The software was used to create computerised drawings for architectural designs, product schematics and floor plans of plants and factories.

Theft of AutoCAD had a serious impact on businesses because the intruders gain access to sensitive intellectual property even before the designs go into production, Zwienenberg said.

Thieves could even apply for a patent before the actual owner.

Medrea modified native start-up files and employed Visual Basic Scripts so that it would be executed whenever an AutoCAD drawing was opened on the infected system, Zwienenberg said. Once the target computer is infected, every new design saved was automatically transferred via email to an account controlled by attackers.

Medrea also looked for and stole Outlook PST files containing email, calendars, contacts and other information.

The worm also contained code to transfer Foxmail Address Book and the Foxmail Send Folder, but failed to do so because of errors in the code, Robert Lipovsky, a malware researcher at ESET, wrote in his technical analysis of the malware.

ESET suspects the malware was initially distributed via infected AutoCAD templates, and the high concentration of infections in Peru implied the compromised organisations had worked on projects within the country's public sector.

While the malware was detected in other parts of Latin America, researchers believed Peru was the primary target.

The Flame malware also had a "high interest in AutoCAD drawings" but in the Middle East, according to Alexander Gostev, chief security expert at Kaspersky Lab.

Duqu, another sophisticated espionage trojan that stole sensitive infrastructure-related data, also recognised AutoCAD documents.

Copyright © SC Magazine, US edition


Malware writers go patent-snatching in Peru
 
 
 
Top Stories
Westpac interim CIO resigns
Group CIO yet to be appointed.
 
Five emerging technologies that will transform financial services
[Blog post] Far out ideas that aren't far off.
 
Earning the right to innovate
Breaking down the barriers to innovation is a long, but rewarding process, says Bank of Queensland Group CIO, Julie Bale.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  27%
 
Application integration concerns
  3%
 
Security and compliance concerns
  28%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 934

Vote