Vulnerabilities / Threats
11:44 AM

McAfee Strikes Back: Spyware Sting Targets Belize Government

Antivirus firm founder's story takes another bizarre twist, as he claims to have found connection between Hezbollah extremists and Belizean government officials.

Eccentric information security expert John McAfee, who recently fled Belize for Guatemala and was then deported to Miami, has detailed his claims of high-level corruption inside the Belizean government.

Specifically, McAfee has accused the government of providing fake identities to members of the extremist Shiite militant group Hezbollah, which he said are working with a Mexican drug cartel to infiltrate the United States. McAfee said he discovered that information after launching a social engineering attack against the government of Belize by buying Acer Aspire One laptops, loading them up with spyware, repackaging the computers to make them appear brand new, and then donating them to targets.

The assertions of McAfee -- who founded and then sold the antivirus firm bearing his name, which is now owned by Intel -- are the latest twist in a story that's seen more surprises than an episode of "24," and that already ranked as one of the stranger security-related stories of 2012.

[ For more on the ongoing McAfee saga, see 6 Wacky McAfee Facts: From Guatemala, With Twists. ]

In a nutshell: 67-year-old McAfee, who holds dual American and British citizenship, was until recently a resident of Belize. But he went on the run after his neighbor, fellow American Gregory Viant Faull, 52, was murdered. McAfee, who claimed that the government was framing him for the murder, later surfaced in Guatemala, where he was jailed for immigration violations. Ultimately, McAfee was deported to Miami, despite unofficial requests by Belizean government officials that he be returned to answer questions in the murder investigation. But McAfee has been charged with no crime by Belizean authorities, and thus now faces no prospect of being extradited to Belize.

Instead, McAfee has used his return to the United States to detail his claims of high-level corruption in the Belizean government, which he said he uncovered by donating spyware-infected laptops to key targets. "I purchased 75 cheap laptop computers and, with trusted help, installed invisible keystroke logging software on all of them -- the kind that calls home (to me) and disgorges the text files. It also, on command, turns on and off, the microphone and camera -- and sends these files on command," said McAfee last week in a blog post with a title -- "A Clear and Present Danger" -- ripped from a Tom Clancy novel.

"I began giving these away as presents to select people -- government employees, police officers, Cabinet Minister's assistants, girlfriends of powerful men, boyfriends of powerful women," he said. "I hired four trusted people full-time to monitor the text files and provide myself with the subsequent passwords for everyone's email, Facebook, private message boards and other passworded accounts. The keystroke monitoring continued after password collection, in order to document text input that would later be deleted. So nothing was missed."

McAfee said his social engineering operation involved 23 women and 6 men whom he hired to serve as his "operatives." Their tasks included delivering the computers as presents to targets, including employees of the country's two national telecommunications companies, to help McAfee gain information for tapping targets' phones. "What I was looking for was hard proof of corruption at a high level. I'm not sure what I expected to gain," said McAfee. "Suffice it to say: I just did it because I could."

Based in part on the information gleaned via the spyware, McAfee said he discovered that the Belizean government was furnishing new identities to members of the extremist group Hezbollah, which was founded in 1982 in Lebanon. "Belize is clearly the central player in a larger network whose goal is to infiltrate the U.S. with individuals having links to terrorist organizations," said McAfee. "What is different today from the wholesale Belizean passport selling of ten years ago is that the false citizenships that are created for these men are coupled with a network of handlers designed to move the individuals, and their cargo, into the U.S."

Notably, McAfee said that a source in the Belizean government's immigration department told him that on average, 11 new arrivals who spoke Lebanese Arabic -- all men -- were being given new identities every month, despite Belize's official requirement that someone reside in the country for five years before they can apply for citizenship and thus hold a Belizean passport. McAfee said the men had arrived from various countries, including Afghanistan, Jordan and Saudi Arabia.

According to McAfee, these Hezbollah operatives have also forged ties with Mexico's Zetas drug cartel and appear to be using a network that's transporting "something similar, in weight and size, to the drugs that the Zetas know so well how to slip into the States."

Despite McAfee's social engineering attack being technically feasible, some information security experts aren't quite sure what to make of McAfee's tale. "Is John McAfee telling the truth? Or spinning a fanciful tale for his own entertainment? There is no way, of course, for us to verify John McAfee's colorful story -- which [claims] that there is an international terrorist conspiracy run from Belize," said Graham Cluley, senior technology consultant at Sophos, in a blog post.

Of course, the story isn't over yet. McAfee said his investigation is ongoing, and he promised to release more information at a future date, after his operatives -- including contacts inside the Zetas -- gather additional intelligence. "In the meantime, I am taking a well-earned vacation into the heartland of the Midwest. I blend well with the ranchers and cowboys that I lived amongst for so many years," he said. is a free platform to build, host and share simple and complex vulnerable Web applications. Find out more about it in this free Black Hat webcast on Jan. 17, with Armando Romeo, founder of eLearnSecurity.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
1/21/2013 | 2:44:08 AM
re: McAfee Strikes Back: Spyware Sting Targets Belize Government
If McAfee is making up this story this is definitely one elaborate tale. IF the Belize Government though he killed his neighbor then why wouldnGt they charge him and try to get him extradited back so that they could deal with him. If this story is true it is disturbing on many different levels and non the less should be investigated as truth and treated as such until otherwise proven differently.

Paul Sprague
InformationWeek Contributor
User Rank: Apprentice
1/8/2013 | 5:52:51 PM
re: McAfee Strikes Back: Spyware Sting Targets Belize Government
McAfee also blogged on this fairy tale saying, "Much of my life is a mystery to me.Gǥ -- Are these the delusional rantings of a paranoid schizophrenic?
5 Reasons the Cybersecurity Labor Shortfall Won't End Soon
Steve Morgan, Founder & CEO, Cybersecurity Ventures,  12/11/2017
Oracle Product Rollout Underscores Need for Trust in the Cloud
Kelly Sheridan, Associate Editor, Dark Reading,  12/11/2017
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Gee, these virtual reality goggles work great!!! 
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.