Feeds

Autocad attacks return after four years in wilderness

The virus makes a comeback

Secure remote control for conventional and virtual desktops

Viruses attacking users of the Autocad computer assisted design application have recently resurfaced after taking a four-year hiatus, prompting a call from one security watcher for more to be done to done to prevent such outbreaks.

And indeed, that's exactly what Autodesk, the California-based maker of the high-end program, has pledged to do.

Over the past few weeks, Sophos Senior Threat Researcher Paul Baccas has spotted two viruses that target Autocad. One of them, dubbed AL/Utax-A, attempts to create new users, a sign that the virus writers are acting out of malicious intent, he said. A newer pest called AL/Logo-A is more of a nuisance. According to an analysis that isn't yet complete, it copies itself to Autocad files, but it isn't believed to modify or delete any data.

To be sure, the resurgence is small, but Baccas says it highlights a very real vulnerability in Autocad and other applications that employ user-generated scripts to automate repetitive tasks. While Microsoft made significant changes to its Office 2007 to blunt the threat of macro-borne attacks, many other application makers have yet to follow suit.

"It's always good for developers to think about security and security holes, especially if they are providing an automated scripting language to automate tasks," Baccas told The Register. "I would like to talk to people from Autodesk about this problem."

Autocad developers are already on the case, said Noah Cole, a senior communications manager at Autodesk. The next version of the program will be redesigned so scripts are loaded in a "more secure and trusted manner," he said.

The most recently discovered virus spreads through a scripting file called acad.vlx, which is transmitted when designers exchange their work. Once it's on a user's machine, it gets loaded each time Autocad is started. Similar Autocad viruses were reported in 2005, but have largely been dormant since then.

Sophos and most other anti-virus programs detect the viruses, Cole said.

More about the viruses is here and here. ®

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.