Vulnerabilities / Threats
1/9/2013
01:05 PM
50%
50%

McAfee Takes Belize: Social Engineering Lesson

Eccentric antivirus firm founder John McAfee says he tricked people with spyware -- using free laptops. Social engineering attacks remain cheap, easy and effective.

Is your business protected against anyone who might try to steal sensitive information by tricking your employees, whether for financial gain or just good old revenge?

Answering that question is the obvious takeaway from eccentric antivirus firm founder John McAfee's claim that he gave 75 inexpensive laptops to government officials and telecommunications employees in Belize, for free. Unbeknownst to the recipients, however, McAfee had installed spyware on the laptops, resealed the laptop boxes to make the gifts appear to be brand new, and hired four people to monitor every keystroke subsequently captured by the spyware, as well as to remotely activate and monitor the laptops' microphones and Webcams.

Beware eccentric information security professionals bearing free laptops. But security pros with a grudge shouldn't be your only worry: What about unscrupulous corporate competitors, foreign nation states or any criminal out to make a quick buck?

It's telling that the man who founded -- and later sold -- the McAfee antivirus firm didn't create a space-age botnet or buy a zero-day exploit to compromise his targets and collect intelligence. Instead, he gave the gift of free consumer electronics, apparently distributed by people he'd hired to sleep with his targets.

"These men and women were given simple training on how to access and load software on someone's computer while they slept or ate or made long phone calls etc.," said McAfee in a blog post. "It's dead simple [to do that] if you're sleeping with someone."

Based on that spyware sting, McAfee claimed to uncover a government-run program that was giving citizenship to an average of 11 men per month, all new arrivals to Belize, and all Lebanese Arabic speakers. According to McAfee, the men are being sent by the extremist group Hezbollah to infiltrate the United States, aided by the Mexican Zetas criminal syndicate.

Is McAfee's tale -- and accompanying allegations of Belizean government corruption -- truth or fiction? So far, definitively answering that question seems impossible, owing to all of the evidence having been disseminated solely by McAfee, via his blog. Add in McAfee's claims that the government of Belize attempted to frame him for the murder of his neighbor, and his subsequent flight from justice -- or at least police questioning -- that saw McAfee flee Belize by land and by boat, trailed by journalists and eventually arriving in Guatemala, from which he was deported to Miami.

All of that suggests we may be dealing with a somewhat unreliable narrator, which is reinforced by his apparent penchant for gonzo journalism, if not spy fiction: "I arranged with 23 women and 6 men to be my operatives," according to his blog post. "Eight of the women were so accomplished that they ended up living with me. It was amazingly more efficient and they were easily convinced to check up on each other. One was so accomplished (Marcia) that she became a double agent and nearly got me killed."

Without a doubt, McAfee -- as he freely admits -- also bears a grudge, beginning from when he said Belizean agents raided his property in April. "I had asked for a simple apology and had received none. I was pissed. They had shot my dog, destroyed my property and stolen hundreds of thousands of dollars worth of things that I valued. They have still not been returned," he said.

Real or not, McAfee's assertions are a reminder of the ease with which people can be tricked through social engineering attacks, which are cheap, hard to detect, and can be just as effective as a high-tech exploit.

Nor are such attacks new. McAfee's ruse, for example, is a slight reworking of the old "free USB drives in the parking lot" trick, in which researchers scatter free USB drives in a parking lot and see how people respond. In one study, 60% of people who picked up one of the USB drives then plugged it into their PC. But when the researchers scattered USB drives that had a Department of Homeland Security logo on them, they found that 90% of people who picked up one of the drives plugged it into their PC.

That finding makes it clear that the lure of the freebie so often trumps any innate security smarts we possess. Businesses must thus beware cheap tricks, which from a data breach standpoint can end up being just as costly as more expensive or esoteric exploits. Accordingly, train employees to not divulge sensitive information without first verifying the identity of the person requesting the information. Install security tools that scan removable storage devices -- smartphones too -- for signs of malware. Above all, get your in-house information security professionals to think like social engineers: If they wanted to take down your organization, where would they start? Then pay them well, and make sure they don't accept free laptops from strangers.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Melanie Rodier
50%
50%
Melanie Rodier,
User Rank: Black Belt
1/23/2013 | 3:36:37 PM
re: McAfee Takes Belize: Social Engineering Lesson
I suspect that here in the U.S people (especially government workers) would probably be a little more reticent to accept a free laptop given security concerns. But most people would probably completely let their guard down if offered a "brand new" iPad...
PJS880
50%
50%
PJS880,
User Rank: Ninja
1/21/2013 | 3:00:22 AM
re: McAfee Takes Belize: Social Engineering Lesson
You have to admit it is a very interesting way to gain access to top accounts. Who doesnG«÷t want a new computer, and who is going to question the that they are not secured after setting their systems up? Is McAfee doing all this because he is angry with the Belize government or does he have a valid beef here with the corruption that is occurring?

Paul Sprague
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3971
Published: 2014-12-25
The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate.

CVE-2014-7193
Published: 2014-12-25
The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site ...

CVE-2004-2771
Published: 2014-12-24
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.

CVE-2014-3569
Published: 2014-12-24
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshak...

CVE-2014-4322
Published: 2014-12-24
drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate certain offset, length, and base values within an ioctl call, which allows attackers to gain privileges or c...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.