Vulnerabilities / Threats
1/9/2013
01:05 PM
50%
50%

McAfee Takes Belize: Social Engineering Lesson

Eccentric antivirus firm founder John McAfee says he tricked people with spyware -- using free laptops. Social engineering attacks remain cheap, easy and effective.

Is your business protected against anyone who might try to steal sensitive information by tricking your employees, whether for financial gain or just good old revenge?

Answering that question is the obvious takeaway from eccentric antivirus firm founder John McAfee's claim that he gave 75 inexpensive laptops to government officials and telecommunications employees in Belize, for free. Unbeknownst to the recipients, however, McAfee had installed spyware on the laptops, resealed the laptop boxes to make the gifts appear to be brand new, and hired four people to monitor every keystroke subsequently captured by the spyware, as well as to remotely activate and monitor the laptops' microphones and Webcams.

Beware eccentric information security professionals bearing free laptops. But security pros with a grudge shouldn't be your only worry: What about unscrupulous corporate competitors, foreign nation states or any criminal out to make a quick buck?

It's telling that the man who founded -- and later sold -- the McAfee antivirus firm didn't create a space-age botnet or buy a zero-day exploit to compromise his targets and collect intelligence. Instead, he gave the gift of free consumer electronics, apparently distributed by people he'd hired to sleep with his targets.

"These men and women were given simple training on how to access and load software on someone's computer while they slept or ate or made long phone calls etc.," said McAfee in a blog post. "It's dead simple [to do that] if you're sleeping with someone."

Based on that spyware sting, McAfee claimed to uncover a government-run program that was giving citizenship to an average of 11 men per month, all new arrivals to Belize, and all Lebanese Arabic speakers. According to McAfee, the men are being sent by the extremist group Hezbollah to infiltrate the United States, aided by the Mexican Zetas criminal syndicate.

Is McAfee's tale -- and accompanying allegations of Belizean government corruption -- truth or fiction? So far, definitively answering that question seems impossible, owing to all of the evidence having been disseminated solely by McAfee, via his blog. Add in McAfee's claims that the government of Belize attempted to frame him for the murder of his neighbor, and his subsequent flight from justice -- or at least police questioning -- that saw McAfee flee Belize by land and by boat, trailed by journalists and eventually arriving in Guatemala, from which he was deported to Miami.

All of that suggests we may be dealing with a somewhat unreliable narrator, which is reinforced by his apparent penchant for gonzo journalism, if not spy fiction: "I arranged with 23 women and 6 men to be my operatives," according to his blog post. "Eight of the women were so accomplished that they ended up living with me. It was amazingly more efficient and they were easily convinced to check up on each other. One was so accomplished (Marcia) that she became a double agent and nearly got me killed."

Without a doubt, McAfee -- as he freely admits -- also bears a grudge, beginning from when he said Belizean agents raided his property in April. "I had asked for a simple apology and had received none. I was pissed. They had shot my dog, destroyed my property and stolen hundreds of thousands of dollars worth of things that I valued. They have still not been returned," he said.

Real or not, McAfee's assertions are a reminder of the ease with which people can be tricked through social engineering attacks, which are cheap, hard to detect, and can be just as effective as a high-tech exploit.

Nor are such attacks new. McAfee's ruse, for example, is a slight reworking of the old "free USB drives in the parking lot" trick, in which researchers scatter free USB drives in a parking lot and see how people respond. In one study, 60% of people who picked up one of the USB drives then plugged it into their PC. But when the researchers scattered USB drives that had a Department of Homeland Security logo on them, they found that 90% of people who picked up one of the drives plugged it into their PC.

That finding makes it clear that the lure of the freebie so often trumps any innate security smarts we possess. Businesses must thus beware cheap tricks, which from a data breach standpoint can end up being just as costly as more expensive or esoteric exploits. Accordingly, train employees to not divulge sensitive information without first verifying the identity of the person requesting the information. Install security tools that scan removable storage devices -- smartphones too -- for signs of malware. Above all, get your in-house information security professionals to think like social engineers: If they wanted to take down your organization, where would they start? Then pay them well, and make sure they don't accept free laptops from strangers.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Melanie Rodier
50%
50%
Melanie Rodier,
User Rank: Black Belt
1/23/2013 | 3:36:37 PM
re: McAfee Takes Belize: Social Engineering Lesson
I suspect that here in the U.S people (especially government workers) would probably be a little more reticent to accept a free laptop given security concerns. But most people would probably completely let their guard down if offered a "brand new" iPad...
PJS880
50%
50%
PJS880,
User Rank: Ninja
1/21/2013 | 3:00:22 AM
re: McAfee Takes Belize: Social Engineering Lesson
You have to admit it is a very interesting way to gain access to top accounts. Who doesnG«÷t want a new computer, and who is going to question the that they are not secured after setting their systems up? Is McAfee doing all this because he is angry with the Belize government or does he have a valid beef here with the corruption that is occurring?

Paul Sprague
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5208
Published: 2014-12-22
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbit...

CVE-2014-7286
Published: 2014-12-22
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.

CVE-2014-8896
Published: 2014-12-22
The Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to modify ...

CVE-2014-8897
Published: 2014-12-22
Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 ...

CVE-2014-8898
Published: 2014-12-22
Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.