Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/22/2011
01:03 PM
Fritz Nelson
Fritz Nelson
Commentary
Connect Directly
Facebook
LinkedIn
Twitter
RSS
E-Mail
50%
50%

McAfee Stews; HP Speculation Brews

McAfee takes heat for fear mongering, while HP watches its future predicted. One scenario envisions an Oracle takeover.

InformationWeek Now--What's Hot Right Now

With well-publicized security breaches on the rise, business is good for vendors hawking security solutions. The danger, of course, is the hawking part. It has always been a tricky business for technology providers tempted to play up the latest problems. The fear mongering can seem self-serving, like a doctor trumpeting the latest flu virus to drum up some seasonal business. For the second time this year, McAfee finds itself under fire in the security community for just such tactics.

As InformationWeek's Mat Schwartz reports, researchers at Symantec, and the outspoken Eugene Kaspersky, CEO of Kaspersky Labs, have now downplayed the sophistication of "Operation Shady RAT." That's the widespread advanced persistent threat (APT) attack, brought to light by McAfee, that allegedly continued for five years and targeted intellectual property from 70 government agencies in 14 different countries. Kaspersky calls out the McAfee conclusions in his blog post "Shoddy RAT." That McAfee report was featured in a lengthy exclusive in the most recent issue of Vanity Fair.

Schwartz writes: "According to Kaspersky, the malware used in the attack was widely known, but relatively unsophisticated, and would be worth just a few hundred dollars on the black market, compared with top botnets, which might fetch $2,000 to $3,000." Schwartz cites similar statements from Symantec researchers, and a rebuttal from McAfee.

When McAfee first revealed "Operation Shady RAT," Dark Reading's Kelly Jackson-Higgins detailed some of the surprising findings, including those from other security researchers--for example, some of the tools the hackers used to hide their whereabouts. Already, security researchers were saying that the Shady RAT findings were nothing new. Jackson-Higgins also reported that the hackers used steganography, "a relatively rarely deployed technique for hiding malicious code or data behind image files or other innocuous-looking files."

The timing of McAfee's report was not a coincidence--right before Black Hat, one of the biggest security gatherings of the year (disclosure: Black Hat is part of UBM TechWeb, also the parent company of InformationWeek).

But this is not the first time McAfee has used a hot security news cycle to generate attention, and not the first time it has come under question for doing so. Earlier this year, right before the RSA Conference in February, McAfee put out a report on Night Dragon, another series of APT attacks going back to 2008. "According to the report," Dark Reading wrote at the time, "Night Dragon combines a variety of attack techniques, including social engineering, spear-phishing, Windows vulnerability exploits, Active Directory compromises, and remote administration tools (RATs)." These attacks reportedly came from Beijing.

As with Shady RAT, several researchers pointed out that the Night Dragon attacks were nothing new.

While the timing of McAfee's reports is opportunistic, many inside the security industry believe that publicizing these attacks is good, even if they are widely known. The attention heaped on this ever-growing series of threats, whether state-sponsored or not, will continue to raise awareness, the argument goes.

In other words, where your data and intellectual property are concerned, a little fear may be a good thing.

Speaking of intellectual property, speculation is rampant on what HP will do with its WebOS asset now that it has decided to kill the related HP devices. After a weekend blowout that saw HP TouchPad's go on sale for $99, only to be scarfed up in buyer frenzy worthy of an Apple product, a few thoughts jump to mind. First, I think we've finally found the price at which an Apple iPad might be vulnerable to some competition. Second, maybe HP still has time to change its mind. Finally, HP must decide what to do with WebOS. Perhaps, as blogger Robert Scoble suggests, HP could sell it solely as a patent armament. Meanwhile, Microsoft is aggressively targeting WebOS developers. It seems Microsoft, with its Mango release of Windows Phone 7 right around the corner, is soaring around all of the dead carcasses like a very smart vulture.

The bigger question is what becomes of HP. InformationWeek's Kurt Marko calls HP "Blue Junior," a nod to what seems to be a move to make HP more like IBM. Marko predicts that HP will also jettison its imaging and printing business soon. But despite whatever exiting the PC and mobile business will drain from HP's attention in the short term, I like the look of a newly-focused HP for the future. As we reported last week, HP must still close its latest acquisition; others, like Microsoft and Oracle, may bid for Autonomy, if only to drive HP's price up.

More enterprise focus is exactly what HP needs, but as Marko and others have pointed out, IBM and Oracle have a big head start, especially in some of the areas in which HP needs to win. A deal for SAP, as complicated as that might be for a very unsettled HP right now, would certainly jostle everyone else in the process. And it's not such a far stretch for the former SAP CEO.

More unsettling, however, was the New York Post's weekend speculation that the Autonomy acquisition would make HP a good target for an Oracle takeover. How such a deal could work with all of the vitriol HP and Oracle have spit at each other through the courts lately, I'll never know. But it drove Wells Fargo's analysts to put together some scenarios for such a deal, including how it could be financed.

That's just silly talk. This far-fetched deal benefits nobody.

Never say never, Wells Fargo's report implored. I'll say it, though: Never. I don’t believe it.

Fritz Nelson is the editorial director for InformationWeek and the Executive Producer of TechWebTV. Fritz writes about startups and established companies alike, but likes to exploit multiple forms of media into his writing.

Follow Fritz Nelson and InformationWeek on Twitter, Facebook, YouTube, LinkedIn, and Google+:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
A Startup With NSA Roots Wants Silently Disarming Cyberattacks on the Wire to Become the Norm
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/11/2021
Edge-DRsplash-10-edge-articles
Cybersecurity: What Is Truly Essential?
Joshua Goldfarb, Director of Product Management at F5,  5/12/2021
Commentary
3 Cybersecurity Myths to Bust
Etay Maor, Sr. Director Security Strategy at Cato Networks,  5/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-18178
PUBLISHED: 2021-05-18
Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."
CVE-2020-20214
PUBLISHED: 2021-05-18
Mikrotik RouterOs 6.44.6 (long-term tree) suffers from an assertion failure vulnerability in the btest process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.
CVE-2020-20222
PUBLISHED: 2021-05-18
Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
CVE-2020-20236
PUBLISHED: 2021-05-18
Mikrotik RouterOs 6.46.3 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.
CVE-2020-20237
PUBLISHED: 2021-05-18
Mikrotik RouterOs 6.46.3 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.