Vulnerabilities / Threats
11:44 AM

McAfee Strikes Back: Spyware Sting Targets Belize Government

Antivirus firm founder's story takes another bizarre twist, as he claims to have found connection between Hezbollah extremists and Belizean government officials.

Eccentric information security expert John McAfee, who recently fled Belize for Guatemala and was then deported to Miami, has detailed his claims of high-level corruption inside the Belizean government.

Specifically, McAfee has accused the government of providing fake identities to members of the extremist Shiite militant group Hezbollah, which he said are working with a Mexican drug cartel to infiltrate the United States. McAfee said he discovered that information after launching a social engineering attack against the government of Belize by buying Acer Aspire One laptops, loading them up with spyware, repackaging the computers to make them appear brand new, and then donating them to targets.

The assertions of McAfee -- who founded and then sold the antivirus firm bearing his name, which is now owned by Intel -- are the latest twist in a story that's seen more surprises than an episode of "24," and that already ranked as one of the stranger security-related stories of 2012.

[ For more on the ongoing McAfee saga, see 6 Wacky McAfee Facts: From Guatemala, With Twists. ]

In a nutshell: 67-year-old McAfee, who holds dual American and British citizenship, was until recently a resident of Belize. But he went on the run after his neighbor, fellow American Gregory Viant Faull, 52, was murdered. McAfee, who claimed that the government was framing him for the murder, later surfaced in Guatemala, where he was jailed for immigration violations. Ultimately, McAfee was deported to Miami, despite unofficial requests by Belizean government officials that he be returned to answer questions in the murder investigation. But McAfee has been charged with no crime by Belizean authorities, and thus now faces no prospect of being extradited to Belize.

Instead, McAfee has used his return to the United States to detail his claims of high-level corruption in the Belizean government, which he said he uncovered by donating spyware-infected laptops to key targets. "I purchased 75 cheap laptop computers and, with trusted help, installed invisible keystroke logging software on all of them -- the kind that calls home (to me) and disgorges the text files. It also, on command, turns on and off, the microphone and camera -- and sends these files on command," said McAfee last week in a blog post with a title -- "A Clear and Present Danger" -- ripped from a Tom Clancy novel.

"I began giving these away as presents to select people -- government employees, police officers, Cabinet Minister's assistants, girlfriends of powerful men, boyfriends of powerful women," he said. "I hired four trusted people full-time to monitor the text files and provide myself with the subsequent passwords for everyone's email, Facebook, private message boards and other passworded accounts. The keystroke monitoring continued after password collection, in order to document text input that would later be deleted. So nothing was missed."

McAfee said his social engineering operation involved 23 women and 6 men whom he hired to serve as his "operatives." Their tasks included delivering the computers as presents to targets, including employees of the country's two national telecommunications companies, to help McAfee gain information for tapping targets' phones. "What I was looking for was hard proof of corruption at a high level. I'm not sure what I expected to gain," said McAfee. "Suffice it to say: I just did it because I could."

Based in part on the information gleaned via the spyware, McAfee said he discovered that the Belizean government was furnishing new identities to members of the extremist group Hezbollah, which was founded in 1982 in Lebanon. "Belize is clearly the central player in a larger network whose goal is to infiltrate the U.S. with individuals having links to terrorist organizations," said McAfee. "What is different today from the wholesale Belizean passport selling of ten years ago is that the false citizenships that are created for these men are coupled with a network of handlers designed to move the individuals, and their cargo, into the U.S."

Notably, McAfee said that a source in the Belizean government's immigration department told him that on average, 11 new arrivals who spoke Lebanese Arabic -- all men -- were being given new identities every month, despite Belize's official requirement that someone reside in the country for five years before they can apply for citizenship and thus hold a Belizean passport. McAfee said the men had arrived from various countries, including Afghanistan, Jordan and Saudi Arabia.

According to McAfee, these Hezbollah operatives have also forged ties with Mexico's Zetas drug cartel and appear to be using a network that's transporting "something similar, in weight and size, to the drugs that the Zetas know so well how to slip into the States."

Despite McAfee's social engineering attack being technically feasible, some information security experts aren't quite sure what to make of McAfee's tale. "Is John McAfee telling the truth? Or spinning a fanciful tale for his own entertainment? There is no way, of course, for us to verify John McAfee's colorful story -- which [claims] that there is an international terrorist conspiracy run from Belize," said Graham Cluley, senior technology consultant at Sophos, in a blog post.

Of course, the story isn't over yet. McAfee said his investigation is ongoing, and he promised to release more information at a future date, after his operatives -- including contacts inside the Zetas -- gather additional intelligence. "In the meantime, I am taking a well-earned vacation into the heartland of the Midwest. I blend well with the ranchers and cowboys that I lived amongst for so many years," he said. is a free platform to build, host and share simple and complex vulnerable Web applications. Find out more about it in this free Black Hat webcast on Jan. 17, with Armando Romeo, founder of eLearnSecurity.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
1/21/2013 | 2:44:08 AM
re: McAfee Strikes Back: Spyware Sting Targets Belize Government
If McAfee is making up this story this is definitely one elaborate tale. IF the Belize Government though he killed his neighbor then why wouldnGt they charge him and try to get him extradited back so that they could deal with him. If this story is true it is disturbing on many different levels and non the less should be investigated as truth and treated as such until otherwise proven differently.

Paul Sprague
InformationWeek Contributor
User Rank: Apprentice
1/8/2013 | 5:52:51 PM
re: McAfee Strikes Back: Spyware Sting Targets Belize Government
McAfee also blogged on this fairy tale saying, "Much of my life is a mystery to me.Gǥ -- Are these the delusional rantings of a paranoid schizophrenic?
Register for Dark Reading Newsletters
White Papers
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.