Page 524 - Using MIS

Security Guide

pSSt. there’S another way, you Know . . .

“All this talk about BPM, and SDLC, and scrum is really un- ACAD/Medre.A was spread by unsuspecting engineers.
necessary. There’s another way, you know. We just download a An AutoCAD design consists of many files, and to transfer a
copy of their source code, and we’re in business. I have a friend design to a collaborator, engineers routinely compress the
who knows how to do that. We’d have the application in sec- files in an AutoCAD design directory into a zip file and send
onds, and it would save so much time and agony, no?”
it to legitimate recipients. Once the worm gets into a design
Industrial espionage is as old as commerce. directory, it’s compressed with the legitimate files and rides
Infiltrating your competitors with spies and stealing what- along in the compressed file. When the recipient decom-
ever you can is nothing new. It’s a way to save hundreds of presses the zip file, ACAD/Medre.A is decompressed as
labor years, maybe more. Of course, if you’re so stupid as to well. It then runs its payload to steal designs and email data.
steal the designs of an iPad, and next month bring your own Why Peru? Apparently, the original infection was
iPad to market, the jig will be up. Apple, the FBI, and who on a server of a Peruvian manufacturer whose suppliers
knows who else will be upon you. needed the manufacturer’s engineering designs to create
So, instead, you can just learn from the stolen designs
and apply your new knowledge to build similar devices,
doing it much faster than you could without the theft. Use
what you learn from, say, iPad touch-screen design to build
your own auto navigation touch screen.
Or choose a company less prominent than Apple. For
example, find out where Jared and his team keep the PRIDE
source code and take it. Then build your own PRIDE system
in another country . . . say, New Zealand or Singapore. How
likely is it for Jared to know you’re running his code in New
Zealand? Not likely, and, if he does learn of it, how much
does he want to pay the one attorney in Austin, Texas, who
knows New Zealand law and prosecution? Plus, how would
he prove you got the code from him?
Sound far-fetched? In June 2012, ESET, the antivirus
software vendor based in Bratislava, Slovakia, detected a
8
big spike in infections of a worm named ACAD/Medre.A.
Initially the spike was in Peru, but the malware soon spread.
Investigation revealed that this worm copies itself into file
folders containing drawings produced using AutoCAD, the
world’s most popular computer-based design software.
Once there, it installs code to send copies of engineering
drawings it finds on the host machine to one of several
email servers in China. If Outlook is installed on the in-
fected computer, it also sends copies of the computer’s con-
tact list and other email data.
Source: © Eliane SULLE/Alamy

8 www.eset.com/fileadmin/Images/US/Docs/Business/white_Papers/ESET_ACAD_Medre_A_whitepaper.pdf.
492