Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:03 PM
Fritz Nelson
Fritz Nelson
Connect Directly

McAfee Stews; HP Speculation Brews

McAfee takes heat for fear mongering, while HP watches its future predicted. One scenario envisions an Oracle takeover.

InformationWeek Now--What's Hot Right Now

With well-publicized security breaches on the rise, business is good for vendors hawking security solutions. The danger, of course, is the hawking part. It has always been a tricky business for technology providers tempted to play up the latest problems. The fear mongering can seem self-serving, like a doctor trumpeting the latest flu virus to drum up some seasonal business. For the second time this year, McAfee finds itself under fire in the security community for just such tactics.

As InformationWeek's Mat Schwartz reports, researchers at Symantec, and the outspoken Eugene Kaspersky, CEO of Kaspersky Labs, have now downplayed the sophistication of "Operation Shady RAT." That's the widespread advanced persistent threat (APT) attack, brought to light by McAfee, that allegedly continued for five years and targeted intellectual property from 70 government agencies in 14 different countries. Kaspersky calls out the McAfee conclusions in his blog post "Shoddy RAT." That McAfee report was featured in a lengthy exclusive in the most recent issue of Vanity Fair.

Schwartz writes: "According to Kaspersky, the malware used in the attack was widely known, but relatively unsophisticated, and would be worth just a few hundred dollars on the black market, compared with top botnets, which might fetch $2,000 to $3,000." Schwartz cites similar statements from Symantec researchers, and a rebuttal from McAfee.

When McAfee first revealed "Operation Shady RAT," Dark Reading's Kelly Jackson-Higgins detailed some of the surprising findings, including those from other security researchers--for example, some of the tools the hackers used to hide their whereabouts. Already, security researchers were saying that the Shady RAT findings were nothing new. Jackson-Higgins also reported that the hackers used steganography, "a relatively rarely deployed technique for hiding malicious code or data behind image files or other innocuous-looking files."

The timing of McAfee's report was not a coincidence--right before Black Hat, one of the biggest security gatherings of the year (disclosure: Black Hat is part of UBM TechWeb, also the parent company of InformationWeek).

But this is not the first time McAfee has used a hot security news cycle to generate attention, and not the first time it has come under question for doing so. Earlier this year, right before the RSA Conference in February, McAfee put out a report on Night Dragon, another series of APT attacks going back to 2008. "According to the report," Dark Reading wrote at the time, "Night Dragon combines a variety of attack techniques, including social engineering, spear-phishing, Windows vulnerability exploits, Active Directory compromises, and remote administration tools (RATs)." These attacks reportedly came from Beijing.

As with Shady RAT, several researchers pointed out that the Night Dragon attacks were nothing new.

While the timing of McAfee's reports is opportunistic, many inside the security industry believe that publicizing these attacks is good, even if they are widely known. The attention heaped on this ever-growing series of threats, whether state-sponsored or not, will continue to raise awareness, the argument goes.

In other words, where your data and intellectual property are concerned, a little fear may be a good thing.

Speaking of intellectual property, speculation is rampant on what HP will do with its WebOS asset now that it has decided to kill the related HP devices. After a weekend blowout that saw HP TouchPad's go on sale for $99, only to be scarfed up in buyer frenzy worthy of an Apple product, a few thoughts jump to mind. First, I think we've finally found the price at which an Apple iPad might be vulnerable to some competition. Second, maybe HP still has time to change its mind. Finally, HP must decide what to do with WebOS. Perhaps, as blogger Robert Scoble suggests, HP could sell it solely as a patent armament. Meanwhile, Microsoft is aggressively targeting WebOS developers. It seems Microsoft, with its Mango release of Windows Phone 7 right around the corner, is soaring around all of the dead carcasses like a very smart vulture.

The bigger question is what becomes of HP. InformationWeek's Kurt Marko calls HP "Blue Junior," a nod to what seems to be a move to make HP more like IBM. Marko predicts that HP will also jettison its imaging and printing business soon. But despite whatever exiting the PC and mobile business will drain from HP's attention in the short term, I like the look of a newly-focused HP for the future. As we reported last week, HP must still close its latest acquisition; others, like Microsoft and Oracle, may bid for Autonomy, if only to drive HP's price up.

More enterprise focus is exactly what HP needs, but as Marko and others have pointed out, IBM and Oracle have a big head start, especially in some of the areas in which HP needs to win. A deal for SAP, as complicated as that might be for a very unsettled HP right now, would certainly jostle everyone else in the process. And it's not such a far stretch for the former SAP CEO.

More unsettling, however, was the New York Post's weekend speculation that the Autonomy acquisition would make HP a good target for an Oracle takeover. How such a deal could work with all of the vitriol HP and Oracle have spit at each other through the courts lately, I'll never know. But it drove Wells Fargo's analysts to put together some scenarios for such a deal, including how it could be financed.

That's just silly talk. This far-fetched deal benefits nobody.

Never say never, Wells Fargo's report implored. I'll say it, though: Never. I don’t believe it.

Fritz Nelson is the editorial director for InformationWeek and the Executive Producer of TechWebTV. Fritz writes about startups and established companies alike, but likes to exploit multiple forms of media into his writing.

Follow Fritz Nelson and InformationWeek on Twitter, Facebook, YouTube, LinkedIn, and Google+:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-01-17
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not incl...
PUBLISHED: 2020-01-17
Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is replaced by a malicious version and the heap dump is reopened in Memory Analyzer. The user must chose to reopen an already parsed heap dump with an untrusted inde...
PUBLISHED: 2020-01-17
It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the way Intel CPUs handle inconsistency between, virtual to physical memory address translations in CPU's local cache and system software's Paging structure entries...
PUBLISHED: 2020-01-17
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-1382. Reason: This candidate is a reservation duplicate of CVE-2008-1382. Notes: All CVE users should reference CVE-2008-1382 instead of this candidate. All references and descriptions in this candidate have been removed to prevent ...
PUBLISHED: 2020-01-17
Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must chose todownload, open the malicious heap dump and generate an HTML report for the problem to occur. The heap dump could...