Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/22/2011
01:03 PM
Fritz Nelson
Fritz Nelson
Commentary
Connect Directly
Facebook
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

McAfee Stews; HP Speculation Brews

McAfee takes heat for fear mongering, while HP watches its future predicted. One scenario envisions an Oracle takeover.

InformationWeek Now--What's Hot Right Now

With well-publicized security breaches on the rise, business is good for vendors hawking security solutions. The danger, of course, is the hawking part. It has always been a tricky business for technology providers tempted to play up the latest problems. The fear mongering can seem self-serving, like a doctor trumpeting the latest flu virus to drum up some seasonal business. For the second time this year, McAfee finds itself under fire in the security community for just such tactics.

As InformationWeek's Mat Schwartz reports, researchers at Symantec, and the outspoken Eugene Kaspersky, CEO of Kaspersky Labs, have now downplayed the sophistication of "Operation Shady RAT." That's the widespread advanced persistent threat (APT) attack, brought to light by McAfee, that allegedly continued for five years and targeted intellectual property from 70 government agencies in 14 different countries. Kaspersky calls out the McAfee conclusions in his blog post "Shoddy RAT." That McAfee report was featured in a lengthy exclusive in the most recent issue of Vanity Fair.

Schwartz writes: "According to Kaspersky, the malware used in the attack was widely known, but relatively unsophisticated, and would be worth just a few hundred dollars on the black market, compared with top botnets, which might fetch $2,000 to $3,000." Schwartz cites similar statements from Symantec researchers, and a rebuttal from McAfee.

When McAfee first revealed "Operation Shady RAT," Dark Reading's Kelly Jackson-Higgins detailed some of the surprising findings, including those from other security researchers--for example, some of the tools the hackers used to hide their whereabouts. Already, security researchers were saying that the Shady RAT findings were nothing new. Jackson-Higgins also reported that the hackers used steganography, "a relatively rarely deployed technique for hiding malicious code or data behind image files or other innocuous-looking files."

The timing of McAfee's report was not a coincidence--right before Black Hat, one of the biggest security gatherings of the year (disclosure: Black Hat is part of UBM TechWeb, also the parent company of InformationWeek).

But this is not the first time McAfee has used a hot security news cycle to generate attention, and not the first time it has come under question for doing so. Earlier this year, right before the RSA Conference in February, McAfee put out a report on Night Dragon, another series of APT attacks going back to 2008. "According to the report," Dark Reading wrote at the time, "Night Dragon combines a variety of attack techniques, including social engineering, spear-phishing, Windows vulnerability exploits, Active Directory compromises, and remote administration tools (RATs)." These attacks reportedly came from Beijing.

As with Shady RAT, several researchers pointed out that the Night Dragon attacks were nothing new.

While the timing of McAfee's reports is opportunistic, many inside the security industry believe that publicizing these attacks is good, even if they are widely known. The attention heaped on this ever-growing series of threats, whether state-sponsored or not, will continue to raise awareness, the argument goes.

In other words, where your data and intellectual property are concerned, a little fear may be a good thing.

Speaking of intellectual property, speculation is rampant on what HP will do with its WebOS asset now that it has decided to kill the related HP devices. After a weekend blowout that saw HP TouchPad's go on sale for $99, only to be scarfed up in buyer frenzy worthy of an Apple product, a few thoughts jump to mind. First, I think we've finally found the price at which an Apple iPad might be vulnerable to some competition. Second, maybe HP still has time to change its mind. Finally, HP must decide what to do with WebOS. Perhaps, as blogger Robert Scoble suggests, HP could sell it solely as a patent armament. Meanwhile, Microsoft is aggressively targeting WebOS developers. It seems Microsoft, with its Mango release of Windows Phone 7 right around the corner, is soaring around all of the dead carcasses like a very smart vulture.

The bigger question is what becomes of HP. InformationWeek's Kurt Marko calls HP "Blue Junior," a nod to what seems to be a move to make HP more like IBM. Marko predicts that HP will also jettison its imaging and printing business soon. But despite whatever exiting the PC and mobile business will drain from HP's attention in the short term, I like the look of a newly-focused HP for the future. As we reported last week, HP must still close its latest acquisition; others, like Microsoft and Oracle, may bid for Autonomy, if only to drive HP's price up.

More enterprise focus is exactly what HP needs, but as Marko and others have pointed out, IBM and Oracle have a big head start, especially in some of the areas in which HP needs to win. A deal for SAP, as complicated as that might be for a very unsettled HP right now, would certainly jostle everyone else in the process. And it's not such a far stretch for the former SAP CEO.

More unsettling, however, was the New York Post's weekend speculation that the Autonomy acquisition would make HP a good target for an Oracle takeover. How such a deal could work with all of the vitriol HP and Oracle have spit at each other through the courts lately, I'll never know. But it drove Wells Fargo's analysts to put together some scenarios for such a deal, including how it could be financed.

That's just silly talk. This far-fetched deal benefits nobody.

Never say never, Wells Fargo's report implored. I'll say it, though: Never. I don’t believe it.

Fritz Nelson is the editorial director for InformationWeek and the Executive Producer of TechWebTV. Fritz writes about startups and established companies alike, but likes to exploit multiple forms of media into his writing.

Follow Fritz Nelson and InformationWeek on Twitter, Facebook, YouTube, LinkedIn, and Google+:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Breaches Are Inevitable, So Embrace the Chaos
Ariel Zeitlin, Chief Technology Officer & Co-Founder, Guardicore,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19010
PUBLISHED: 2019-11-16
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
CVE-2019-16761
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the [email protected] npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. All versions >1.0...
CVE-2019-16762
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any...
CVE-2019-13581
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A heap-based buffer overflow allows remote attackers to cause a denial of service or execute arbitrary ...
CVE-2019-13582
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.