Vulnerabilities / Threats
1/8/2013
11:44 AM
Connect Directly
RSS
E-Mail
50%
50%

McAfee Strikes Back: Spyware Sting Targets Belize Government

Antivirus firm founder's story takes another bizarre twist, as he claims to have found connection between Hezbollah extremists and Belizean government officials.

Eccentric information security expert John McAfee, who recently fled Belize for Guatemala and was then deported to Miami, has detailed his claims of high-level corruption inside the Belizean government.

Specifically, McAfee has accused the government of providing fake identities to members of the extremist Shiite militant group Hezbollah, which he said are working with a Mexican drug cartel to infiltrate the United States. McAfee said he discovered that information after launching a social engineering attack against the government of Belize by buying Acer Aspire One laptops, loading them up with spyware, repackaging the computers to make them appear brand new, and then donating them to targets.

The assertions of McAfee -- who founded and then sold the antivirus firm bearing his name, which is now owned by Intel -- are the latest twist in a story that's seen more surprises than an episode of "24," and that already ranked as one of the stranger security-related stories of 2012.

[ For more on the ongoing McAfee saga, see 6 Wacky McAfee Facts: From Guatemala, With Twists. ]

In a nutshell: 67-year-old McAfee, who holds dual American and British citizenship, was until recently a resident of Belize. But he went on the run after his neighbor, fellow American Gregory Viant Faull, 52, was murdered. McAfee, who claimed that the government was framing him for the murder, later surfaced in Guatemala, where he was jailed for immigration violations. Ultimately, McAfee was deported to Miami, despite unofficial requests by Belizean government officials that he be returned to answer questions in the murder investigation. But McAfee has been charged with no crime by Belizean authorities, and thus now faces no prospect of being extradited to Belize.

Instead, McAfee has used his return to the United States to detail his claims of high-level corruption in the Belizean government, which he said he uncovered by donating spyware-infected laptops to key targets. "I purchased 75 cheap laptop computers and, with trusted help, installed invisible keystroke logging software on all of them -- the kind that calls home (to me) and disgorges the text files. It also, on command, turns on and off, the microphone and camera -- and sends these files on command," said McAfee last week in a blog post with a title -- "A Clear and Present Danger" -- ripped from a Tom Clancy novel.

"I began giving these away as presents to select people -- government employees, police officers, Cabinet Minister's assistants, girlfriends of powerful men, boyfriends of powerful women," he said. "I hired four trusted people full-time to monitor the text files and provide myself with the subsequent passwords for everyone's email, Facebook, private message boards and other passworded accounts. The keystroke monitoring continued after password collection, in order to document text input that would later be deleted. So nothing was missed."

McAfee said his social engineering operation involved 23 women and 6 men whom he hired to serve as his "operatives." Their tasks included delivering the computers as presents to targets, including employees of the country's two national telecommunications companies, to help McAfee gain information for tapping targets' phones. "What I was looking for was hard proof of corruption at a high level. I'm not sure what I expected to gain," said McAfee. "Suffice it to say: I just did it because I could."

Based in part on the information gleaned via the spyware, McAfee said he discovered that the Belizean government was furnishing new identities to members of the extremist group Hezbollah, which was founded in 1982 in Lebanon. "Belize is clearly the central player in a larger network whose goal is to infiltrate the U.S. with individuals having links to terrorist organizations," said McAfee. "What is different today from the wholesale Belizean passport selling of ten years ago is that the false citizenships that are created for these men are coupled with a network of handlers designed to move the individuals, and their cargo, into the U.S."

Notably, McAfee said that a source in the Belizean government's immigration department told him that on average, 11 new arrivals who spoke Lebanese Arabic -- all men -- were being given new identities every month, despite Belize's official requirement that someone reside in the country for five years before they can apply for citizenship and thus hold a Belizean passport. McAfee said the men had arrived from various countries, including Afghanistan, Jordan and Saudi Arabia.

According to McAfee, these Hezbollah operatives have also forged ties with Mexico's Zetas drug cartel and appear to be using a network that's transporting "something similar, in weight and size, to the drugs that the Zetas know so well how to slip into the States."

Despite McAfee's social engineering attack being technically feasible, some information security experts aren't quite sure what to make of McAfee's tale. "Is John McAfee telling the truth? Or spinning a fanciful tale for his own entertainment? There is no way, of course, for us to verify John McAfee's colorful story -- which [claims] that there is an international terrorist conspiracy run from Belize," said Graham Cluley, senior technology consultant at Sophos, in a blog post.

Of course, the story isn't over yet. McAfee said his investigation is ongoing, and he promised to release more information at a future date, after his operatives -- including contacts inside the Zetas -- gather additional intelligence. "In the meantime, I am taking a well-earned vacation into the heartland of the Midwest. I blend well with the ranchers and cowboys that I lived amongst for so many years," he said.

Hack.me is a free platform to build, host and share simple and complex vulnerable Web applications. Find out more about it in this free Black Hat webcast on Jan. 17, with Armando Romeo, founder of eLearnSecurity.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
1/21/2013 | 2:44:08 AM
re: McAfee Strikes Back: Spyware Sting Targets Belize Government
If McAfee is making up this story this is definitely one elaborate tale. IF the Belize Government though he killed his neighbor then why wouldnGÇÖt they charge him and try to get him extradited back so that they could deal with him. If this story is true it is disturbing on many different levels and non the less should be investigated as truth and treated as such until otherwise proven differently.

Paul Sprague
InformationWeek Contributor
JerryJ
50%
50%
JerryJ,
User Rank: Apprentice
1/8/2013 | 5:52:51 PM
re: McAfee Strikes Back: Spyware Sting Targets Belize Government
McAfee also blogged on this fairy tale saying, "Much of my life is a mystery to me.GÇ¥ -- Are these the delusional rantings of a paranoid schizophrenic?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2595
Published: 2014-08-31
The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which all...

CVE-2013-2597
Published: 2014-08-31
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that lever...

CVE-2013-2598
Published: 2014-08-31
app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to overwrite signature-verification code via crafted boot-image load-destination header values that specify memory ...

CVE-2013-2599
Published: 2014-08-31
A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption pas...

CVE-2013-6124
Published: 2014-08-31
The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary fil...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.