Slashdot Mirror
I've Got a Bridge To Sell You. Why AutoCAD Malware Keeps Chugging On (arstechnica.com)
Criminal hackers continue to exploit a feature in Autodesk's widely used AutoCAD program in an attempt to steal valuable computer-assisted designs for bridges, factory buildings, and other projects, researchers say. From a report: The attacks arrive in spear-phishing emails and in some cases postal packages that contain design documents and plans. Included in the same directory are camouflaged files formatted in AutoLISP, an AutoCAD-specific dialect of the LISP programming language. When targets open the design document, they may inadvertently cause the AutoLISP file to be executed. While modern versions of AutoCAD by default display a warning that a potentially unsafe script will run, the warnings can be disregarded or suppressed altogether. To make the files less conspicuous, the attackers have set their properties to be hidden in Windows and their contents to be encrypted.
The attacks aren't new. Similar ones occurred as long ago as 2005, before AutoCAD provided the same set of robust defenses against targeted malware it does now. The attacks continued to go strong in 2009. A specific campaign recently spotted by security firm Forcepoint was active as recently as this year and has been active since at least 2014, an indication that malware targeting blueprints isn't going away any time soon. [...] Forcepoint said it has tracked more than 200 data sets and about 40 unique malicious modules, including one that purported to include a design for Hong Kong's Zhuhai-Macau Bridge.
The attacks aren't new. Similar ones occurred as long ago as 2005, before AutoCAD provided the same set of robust defenses against targeted malware it does now. The attacks continued to go strong in 2009. A specific campaign recently spotted by security firm Forcepoint was active as recently as this year and has been active since at least 2014, an indication that malware targeting blueprints isn't going away any time soon. [...] Forcepoint said it has tracked more than 200 data sets and about 40 unique malicious modules, including one that purported to include a design for Hong Kong's Zhuhai-Macau Bridge.
french toast for the ladies
Historically, they've treated your computer as theirs.
https://www.youtube.com/c/BrendaEM
It's honestly kind of a pity that AutoCAD is still a thing. Classic example of network effects much like Microsoft Office. People use it because other people use it more than because of the merits of the software. As software goes it's fine (more or less) but it annoys me that there never has been (to my knowledge) any leading edge CAD software that is open source. Yes there are some options but they tend to trail the closed source options rather badly - often to the point of being basically toys in comparison. To be fair it's a hard problem that requires a lot of domain expertise and math chops. Probably are some patent issues too. But AutoCAD was showing its age decades ago and while it's continued to improve, it's kind of shocking the open source community hasn't provided a viable alternative in the last 20 years to AutoCAD, Solidworks and the rest of the CAD offerings for professional engineering use.
formatted in AutoLISP, an AutoCAD-specific dialect of the LISP programming language.
With apologies to Dorothy Parker, what fresh hell is this?
it's similar story to the tale from the crypts about yellow rain and wet feet of yellow snow consumers who are under impression that if it's under den of storm roof - its safe to eat. they want you to believe that all that bullshit that happens to your personal computing adventures happens for the reason attributable to some forces of negative nature. You know they are forces of nurturing love that trumps negativity with positively charged particles of positron gun. Try putting it in perspective. It's even more mission impossible to code simple website by using pure HTML nowadays than 20 years ago..
If you are still using AutoCAD, you deserve exactly what you get. That's all I have to say about that.
Anyone know why you'd want to script CAD documents anyway? Honestly curious.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
With apologies to Dorothy Parker, what fresh hell is this?
Might be hell but it's not fresh. It's been around for over 30 years. I cannot speak to its merits good or bad but it's definitely not new.
Anyone know why you'd want to script CAD documents anyway?
Many of the same sorts of reasons you would want to script office documents like a spreadsheet. Integration with databases is a biggie. Having data in your drawings that can be obtained/maintained dynamically can be a big win. Macros are pretty useful. From a user's perspective it's often about automating tasks which often can be quite repetitive in CAD.
Nobody has ever tried to steal my Bridge Builder designs.
Comment removed based on user account deletion
Sounds like the civil engineering world still uses it. But I always assumed big expensive projects used something like NX or Catia. Mid-level projects use Solidworks.
Last time I used AutoCAD, it was way behind everything else. It was only used for very basic designs.
Perhaps that's why it's a popular vector for malware. Companies that use it are small, and have fewer resources to spend on security.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Is this governments getting infrastructure plans for targeted attacks? Is this terrorists? Is this competitors looking for information about engineering processes?
Someone is responsible for this. Who?
Create some bad cad files for it to steal. One could be huge. Another overly complex. Or good design at first glance but has engineering flaws.
In fact, why not just create a program to constantly generate them.
I always think this is the best way to deal with spam asking for personal details. "Why yes I am interested in your product or service. My name is Count Monty of Gotham"
I hope they don't steal my AccuJackulator5000 designs. I'm going to make million$$!
The Autocad software, and human labor expended, will likely be worth more than the computer itself.
Autocad supports " AutoLISP, Visual LISP, VBA, .NET and ObjectARX. ObjectARX is a C++ class library"
Wow!!! Old school hacker, 90s MS drone, or hispter javascript slinger, Autocad has you covered! Big kudos to the devs!!!!
I've wondered why there isn't a standardized bridge of length x, to carry ~4 standard lanes of American traffic? Why design a new bridge each time?
There is a *huge* amount of overburdened CAD software out there, missing critical features and focusing on *Paradigm*!!! *Shifts*!!! with each new release.
I still remember throwing out all the network graphing software I had in favor of some qood quality wiring diagram software, that had the concept of "this bus has these wires" and "this is an input, this is an output, this is the wirelist".
Get a computer, isolate it from your real net, and put some bogus designs. A pedestrian bridge overbuilt enough to handle a tank's weight. A high rise apartment with no provision for elevators. A bridge designed in Florida.
Quit whining and get coding.
Not everybody in the world is a professional programmer. How about I suggest you learn how to farm the next time you get hungry? Did you build your house from scratch? How about you design and build a new car yourself the next time you want a better one?
Open source software for sketching and drafting works quite well
Speaking as an engineer who has dealt with this sort of software for years, I can comfortably state that this is not true in a professional engineering context. There is no open source software that is in any danger of duplicating, much less improving on the leading proprietary CAD software available today. It's not even close. The open source stuff that is available is barely more than a toy by comparison.
For transportation at least, plans and sections are being replaced with full 3d models. You define a layer of pavement or a utility duct path and elevation and it will model it. I don't see how open source would come close to handling these particular cases.
The move to 3D models happened decades ago. I was doing 3D solid modeling for automobiles 20 years ago using CATIA, Pro/E, Unigraphics etc. Your statement about open source is a non-sequitur. Open source is a methodology, not a product. You can have a piece of software that does 3D solid modeling that happens to licensed open source. Someone just has to build it first and release it with an open source license and to date nobody really has.
You may not be familiar with modern CAD systems. They are not simple 2D and 3D modeling anymore.
Not only am I familiar with them, I've probably spent more time with them than almost everyone who will ever read this comment. Stop conflating CAD software with PLM/PDM/ERP/MRP systems. They are related but are not the same thing.
They are hugely complicated programs now that manage design, drawings, material schedules, equipment lists, interferences, pipe stress, etc. It is simply too complex for an open source project that will be under supported.
This statement is misleading. Most large open source projects are funded by and developed by major corporations. One of them could in principle release their software with an open source license tomorrow and it would change nothing about how it is developed. You're quite right that the CAD systems used by major corporations are often part of a larger ecosystem of project management software. But there are a LOT of companies that still use 2D/3D autocad style software in a standalone (or nearly so) context which have no requirement the sort of project management software you are referring to.