Vulnerabilities / Threats
1/9/2013
01:05 PM
Connect Directly
RSS
E-Mail
50%
50%

McAfee Takes Belize: Social Engineering Lesson

Eccentric antivirus firm founder John McAfee says he tricked people with spyware -- using free laptops. Social engineering attacks remain cheap, easy and effective.

Is your business protected against anyone who might try to steal sensitive information by tricking your employees, whether for financial gain or just good old revenge?

Answering that question is the obvious takeaway from eccentric antivirus firm founder John McAfee's claim that he gave 75 inexpensive laptops to government officials and telecommunications employees in Belize, for free. Unbeknownst to the recipients, however, McAfee had installed spyware on the laptops, resealed the laptop boxes to make the gifts appear to be brand new, and hired four people to monitor every keystroke subsequently captured by the spyware, as well as to remotely activate and monitor the laptops' microphones and Webcams.

Beware eccentric information security professionals bearing free laptops. But security pros with a grudge shouldn't be your only worry: What about unscrupulous corporate competitors, foreign nation states or any criminal out to make a quick buck?

It's telling that the man who founded -- and later sold -- the McAfee antivirus firm didn't create a space-age botnet or buy a zero-day exploit to compromise his targets and collect intelligence. Instead, he gave the gift of free consumer electronics, apparently distributed by people he'd hired to sleep with his targets.

"These men and women were given simple training on how to access and load software on someone's computer while they slept or ate or made long phone calls etc.," said McAfee in a blog post. "It's dead simple [to do that] if you're sleeping with someone."

Based on that spyware sting, McAfee claimed to uncover a government-run program that was giving citizenship to an average of 11 men per month, all new arrivals to Belize, and all Lebanese Arabic speakers. According to McAfee, the men are being sent by the extremist group Hezbollah to infiltrate the United States, aided by the Mexican Zetas criminal syndicate.

Is McAfee's tale -- and accompanying allegations of Belizean government corruption -- truth or fiction? So far, definitively answering that question seems impossible, owing to all of the evidence having been disseminated solely by McAfee, via his blog. Add in McAfee's claims that the government of Belize attempted to frame him for the murder of his neighbor, and his subsequent flight from justice -- or at least police questioning -- that saw McAfee flee Belize by land and by boat, trailed by journalists and eventually arriving in Guatemala, from which he was deported to Miami.

All of that suggests we may be dealing with a somewhat unreliable narrator, which is reinforced by his apparent penchant for gonzo journalism, if not spy fiction: "I arranged with 23 women and 6 men to be my operatives," according to his blog post. "Eight of the women were so accomplished that they ended up living with me. It was amazingly more efficient and they were easily convinced to check up on each other. One was so accomplished (Marcia) that she became a double agent and nearly got me killed."

Without a doubt, McAfee -- as he freely admits -- also bears a grudge, beginning from when he said Belizean agents raided his property in April. "I had asked for a simple apology and had received none. I was pissed. They had shot my dog, destroyed my property and stolen hundreds of thousands of dollars worth of things that I valued. They have still not been returned," he said.

Real or not, McAfee's assertions are a reminder of the ease with which people can be tricked through social engineering attacks, which are cheap, hard to detect, and can be just as effective as a high-tech exploit.

Nor are such attacks new. McAfee's ruse, for example, is a slight reworking of the old "free USB drives in the parking lot" trick, in which researchers scatter free USB drives in a parking lot and see how people respond. In one study, 60% of people who picked up one of the USB drives then plugged it into their PC. But when the researchers scattered USB drives that had a Department of Homeland Security logo on them, they found that 90% of people who picked up one of the drives plugged it into their PC.

That finding makes it clear that the lure of the freebie so often trumps any innate security smarts we possess. Businesses must thus beware cheap tricks, which from a data breach standpoint can end up being just as costly as more expensive or esoteric exploits. Accordingly, train employees to not divulge sensitive information without first verifying the identity of the person requesting the information. Install security tools that scan removable storage devices -- smartphones too -- for signs of malware. Above all, get your in-house information security professionals to think like social engineers: If they wanted to take down your organization, where would they start? Then pay them well, and make sure they don't accept free laptops from strangers.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Melanie Rodier
50%
50%
Melanie Rodier,
User Rank: Black Belt
1/23/2013 | 3:36:37 PM
re: McAfee Takes Belize: Social Engineering Lesson
I suspect that here in the U.S people (especially government workers) would probably be a little more reticent to accept a free laptop given security concerns. But most people would probably completely let their guard down if offered a "brand new" iPad...
PJS880
50%
50%
PJS880,
User Rank: Ninja
1/21/2013 | 3:00:22 AM
re: McAfee Takes Belize: Social Engineering Lesson
You have to admit it is a very interesting way to gain access to top accounts. Who doesnG«÷t want a new computer, and who is going to question the that they are not secured after setting their systems up? Is McAfee doing all this because he is angry with the Belize government or does he have a valid beef here with the corruption that is occurring?

Paul Sprague
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3090
Published: 2014-09-23
IBM Rational ClearCase 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVE-2014-3101
Published: 2014-09-23
The login form in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not insert a delay after a failed authentication attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.

CVE-2014-3103
Published: 2014-09-23
The Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http...

CVE-2014-3104
Published: 2014-09-23
IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVE-2014-3105
Published: 2014-09-23
The OSLC integration feature in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account n...

Best of the Web
Dark Reading Radio