Malware found sucking up data on new Japanese space agency rocket

[Jack]

Japan’s space agency said on Friday that it found a computer virus on one of its desktop computers that was stealing data on one of its newest rockets and beaming it to controllers outside the agency, the New York Times reported.

The Japan Aerospace Exploration Agency (JAXA) said in a statement that the virus was found in a computer at its Tsukuba Space Center, northeast of Tokyo.

JAXA said anti-virus software detected the bug on November 21st, after which it conducted an emergency sweep for viruses that showed no other infected computers at the center.

The agency isn't sure whether the virus constitutes a cyberattack. But as the New York Times notes, Japanese defense companies have recently been targeted by similar data-siphoning Trojans, some traced to China.

Thieves this time around made off with data about the Epsilon, a solid-fuel rocket with artificial intelligence that Japan plans to send on its virgin flight in 2013.

The artificial intelligence will allow it to be remotely controlled by desktop computer.

This recent infection is the latest in a string of data pilfering targeting JAXA.

Read more: http://nakedsecurity.sophos.com/2012/12/03/malware-found-sucking-up-data-on-new-japanese-space-agency-rocket/

 

[Gnosis]

Japan’s space agency said on Friday that it found a computer virus

I hope the term "virus" is being misused, yet again, to describe a rootkit or other malware, because mistaking a rootkit to be a virus could prove catastrophic.

I cannot see a virus stealing data. Viruses are not very stealthy either. I would say that a virus/rootkit hybrid would be more likely,but that would not be needed unless it is intended to mass infect millions of computers. I would say the virus is a decoy, as to give a false sense of securtiy when it is removed, only to leave the intel gathering tools of the rootkit behind, but I don't think a hacker wants any malware removal going on when he is trying to extract intel. I could imagine that the virus was part of the exploit, but they are really to noisy for a calculated malicious data extraction operation, unless the rootkit's tools are so embedded that only a virus shows up and is able to be removed.
Like the article implied, it could just be a random infection because someone was not "surfing safe" on critical OS's. Regardless, where there is data extraction, there is a rootkit with a keylogger and sceen shots, at the very least.

Sounds like they could use ESET, Comodo, Emsisoft, KIS, Threatfire, or Malware Defender.