McAfee Takes Belize: Social Engineering Lesson

Is your business protected against anyone who might try to steal sensitive information by tricking your employees, whether for financial gain or just good old revenge?

Answering that question is the obvious takeaway from eccentric antivirus firm founder John McAfee's claim that he gave 75 inexpensive laptops to government officials and telecommunications employees in Belize, for free. Unbeknownst to the recipients, however, McAfee had installed spyware on the laptops, resealed the laptop boxes to make the gifts appear to be brand new, and hired four people to monitor every keystroke subsequently captured by the spyware, as well as to remotely activate and monitor the laptops' microphones and Webcams.

Beware eccentric information security professionals bearing free laptops. But security pros with a grudge shouldn't be your only worry: What about unscrupulous corporate competitors, foreign nation states or any criminal out to make a quick buck?

It's telling that the man who founded -- and later sold -- the McAfee antivirus firm didn't create a space-age botnet or buy a zero-day exploit to compromise his targets and collect intelligence. Instead, he gave the gift of free consumer electronics, apparently distributed by people he'd hired to sleep with his targets.

"These men and women were given simple training on how to access and load software on someone's computer while they slept or ate or made long phone calls etc.," said McAfee in a blog post. "It's dead simple [to do that] if you're sleeping with someone."

Based on that spyware sting, McAfee claimed to uncover a government-run program that was giving citizenship to an average of 11 men per month, all new arrivals to Belize, and all Lebanese Arabic speakers. According to McAfee, the men are being sent by the extremist group Hezbollah to infiltrate the United States, aided by the Mexican Zetas criminal syndicate.

Is McAfee's tale -- and accompanying allegations of Belizean government corruption -- truth or fiction? So far, definitively answering that question seems impossible, owing to all of the evidence having been disseminated solely by McAfee, via his blog. Add in McAfee's claims that the government of Belize attempted to frame him for the murder of his neighbor, and his subsequent flight from justice -- or at least police questioning -- that saw McAfee flee Belize by land and by boat, trailed by journalists and eventually arriving in Guatemala, from which he was deported to Miami.

All of that suggests we may be dealing with a somewhat unreliable narrator, which is reinforced by his apparent penchant for gonzo journalism, if not spy fiction: "I arranged with 23 women and 6 men to be my operatives," according to his blog post. "Eight of the women were so accomplished that they ended up living with me. It was amazingly more efficient and they were easily convinced to check up on each other. One was so accomplished (Marcia) that she became a double agent and nearly got me killed."

Without a doubt, McAfee -- as he freely admits -- also bears a grudge, beginning from when he said Belizean agents raided his property in April. "I had asked for a simple apology and had received none. I was pissed. They had shot my dog, destroyed my property and stolen hundreds of thousands of dollars worth of things that I valued. They have still not been returned," he said.

Real or not, McAfee's assertions are a reminder of the ease with which people can be tricked through social engineering attacks, which are cheap, hard to detect, and can be just as effective as a high-tech exploit.

Nor are such attacks new. McAfee's ruse, for example, is a slight reworking of the old "free USB drives in the parking lot" trick, in which researchers scatter free USB drives in a parking lot and see how people respond. In one study, 60% of people who picked up one of the USB drives then plugged it into their PC. But when the researchers scattered USB drives that had a Department of Homeland Security logo on them, they found that 90% of people who picked up one of the drives plugged it into their PC.

That finding makes it clear that the lure of the freebie so often trumps any innate security smarts we possess. Businesses must thus beware cheap tricks, which from a data breach standpoint can end up being just as costly as more expensive or esoteric exploits. Accordingly, train employees to not divulge sensitive information without first verifying the identity of the person requesting the information. Install security tools that scan removable storage devices -- smartphones too -- for signs of malware. Above all, get your in-house information security professionals to think like social engineers: If they wanted to take down your organization, where would they start? Then pay them well, and make sure they don't accept free laptops from strangers.