Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

McAfee Strikes Back: Spyware Sting Targets Belize Government

Antivirus firm founder's story takes another bizarre twist, as he claims to have found connection between Hezbollah extremists and Belizean government officials.

Eccentric information security expert John McAfee, who recently fled Belize for Guatemala and was then deported to Miami, has detailed his claims of high-level corruption inside the Belizean government.

Specifically, McAfee has accused the government of providing fake identities to members of the extremist Shiite militant group Hezbollah, which he said are working with a Mexican drug cartel to infiltrate the United States. McAfee said he discovered that information after launching a social engineering attack against the government of Belize by buying Acer Aspire One laptops, loading them up with spyware, repackaging the computers to make them appear brand new, and then donating them to targets.

The assertions of McAfee -- who founded and then sold the antivirus firm bearing his name, which is now owned by Intel -- are the latest twist in a story that's seen more surprises than an episode of "24," and that already ranked as one of the stranger security-related stories of 2012.

[ For more on the ongoing McAfee saga, see 6 Wacky McAfee Facts: From Guatemala, With Twists. ]

In a nutshell: 67-year-old McAfee, who holds dual American and British citizenship, was until recently a resident of Belize. But he went on the run after his neighbor, fellow American Gregory Viant Faull, 52, was murdered. McAfee, who claimed that the government was framing him for the murder, later surfaced in Guatemala, where he was jailed for immigration violations. Ultimately, McAfee was deported to Miami, despite unofficial requests by Belizean government officials that he be returned to answer questions in the murder investigation. But McAfee has been charged with no crime by Belizean authorities, and thus now faces no prospect of being extradited to Belize.

Instead, McAfee has used his return to the United States to detail his claims of high-level corruption in the Belizean government, which he said he uncovered by donating spyware-infected laptops to key targets. "I purchased 75 cheap laptop computers and, with trusted help, installed invisible keystroke logging software on all of them -- the kind that calls home (to me) and disgorges the text files. It also, on command, turns on and off, the microphone and camera -- and sends these files on command," said McAfee last week in a blog post with a title -- "A Clear and Present Danger" -- ripped from a Tom Clancy novel.

"I began giving these away as presents to select people -- government employees, police officers, Cabinet Minister's assistants, girlfriends of powerful men, boyfriends of powerful women," he said. "I hired four trusted people full-time to monitor the text files and provide myself with the subsequent passwords for everyone's email, Facebook, private message boards and other passworded accounts. The keystroke monitoring continued after password collection, in order to document text input that would later be deleted. So nothing was missed."

McAfee said his social engineering operation involved 23 women and 6 men whom he hired to serve as his "operatives." Their tasks included delivering the computers as presents to targets, including employees of the country's two national telecommunications companies, to help McAfee gain information for tapping targets' phones. "What I was looking for was hard proof of corruption at a high level. I'm not sure what I expected to gain," said McAfee. "Suffice it to say: I just did it because I could."

Based in part on the information gleaned via the spyware, McAfee said he discovered that the Belizean government was furnishing new identities to members of the extremist group Hezbollah, which was founded in 1982 in Lebanon. "Belize is clearly the central player in a larger network whose goal is to infiltrate the U.S. with individuals having links to terrorist organizations," said McAfee. "What is different today from the wholesale Belizean passport selling of ten years ago is that the false citizenships that are created for these men are coupled with a network of handlers designed to move the individuals, and their cargo, into the U.S."

Notably, McAfee said that a source in the Belizean government's immigration department told him that on average, 11 new arrivals who spoke Lebanese Arabic -- all men -- were being given new identities every month, despite Belize's official requirement that someone reside in the country for five years before they can apply for citizenship and thus hold a Belizean passport. McAfee said the men had arrived from various countries, including Afghanistan, Jordan and Saudi Arabia.

According to McAfee, these Hezbollah operatives have also forged ties with Mexico's Zetas drug cartel and appear to be using a network that's transporting "something similar, in weight and size, to the drugs that the Zetas know so well how to slip into the States."

Despite McAfee's social engineering attack being technically feasible, some information security experts aren't quite sure what to make of McAfee's tale. "Is John McAfee telling the truth? Or spinning a fanciful tale for his own entertainment? There is no way, of course, for us to verify John McAfee's colorful story -- which [claims] that there is an international terrorist conspiracy run from Belize," said Graham Cluley, senior technology consultant at Sophos, in a blog post.

Of course, the story isn't over yet. McAfee said his investigation is ongoing, and he promised to release more information at a future date, after his operatives -- including contacts inside the Zetas -- gather additional intelligence. "In the meantime, I am taking a well-earned vacation into the heartland of the Midwest. I blend well with the ranchers and cowboys that I lived amongst for so many years," he said.

Hack.me is a free platform to build, host and share simple and complex vulnerable Web applications. Find out more about it in this free Black Hat webcast on Jan. 17, with Armando Romeo, founder of eLearnSecurity.


Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
1/21/2013 | 2:44:08 AM
re: McAfee Strikes Back: Spyware Sting Targets Belize Government
If McAfee is making up this story this is definitely one elaborate tale. IF the Belize Government though he killed his neighbor then why wouldnGt they charge him and try to get him extradited back so that they could deal with him. If this story is true it is disturbing on many different levels and non the less should be investigated as truth and treated as such until otherwise proven differently.

Paul Sprague
InformationWeek Contributor
User Rank: Apprentice
1/8/2013 | 5:52:51 PM
re: McAfee Strikes Back: Spyware Sting Targets Belize Government
McAfee also blogged on this fairy tale saying, "Much of my life is a mystery to me.Gǥ -- Are these the delusional rantings of a paranoid schizophrenic?
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.