McAfee gets defensive: Massive cyber attack revelation not being used as a security sales tactic

McAfee today published a report that tells how it discovered evidence in a server on the Internet of stealthy intrusions, probably by an unnamed "nation-state," into 72 businesses and government agencies since 2006. The goal, says McAfee, is to steal massive amounts of confidential information.

More security news: US wants to build cybersecurity protection plan for cars

However, in a conference call with press today, McAfee found itself fending off reporter questions asking whether the company was taking advantage of the situation by using this cache of hacker information in its "Revealed: Operation Shady RAT" to gain new customers. Dmitri Alperovitch, vice president of threat research at McAfee Labs, said McAfee has tried to reach government agencies and businesses it can identify through some evidence to let them know about these hacker intrusions, but rebutted any insinuation that the McAfee research was being used as a sales tool.

"Some IP addresses are very clear, they're the firewall of an organization," said Alperovitch about some of the evidence that McAfee that got from the server logs. McAfee says many businesses and government agencies, especially in the U.S., have been infiltrated. McAfee is still investigating some of the log data it says it obtained "legally" from this server in March, which it had first noticed in 2009 as suspicious. McAfee says this server is one of "hundreds if not thousands" organized to carry out so-called "advanced persistent threats" against organizations. APTs are typically defined as stealthy attacks into networks to get hold of valuable information for purposes of cyber-espionage.

McAfee has gone to some of those organizations it clearly believes have been hit to let them know, Alperovitch said. In one instance, McAfee reached out to the World Anti-Doping Agency in Montreal, though contact was initially misunderstood. McAfee maintains "customer confidentiality agreements" when it shares information with organizations that have been hit by the stealthy attacks aimed at stealing sensitive information, such as intellectual property. Alperovitch said most companies it told about its findings did not want to be publicly named. He adds the server is still out there in operation.

The McAfee 14-page report mentions few of the targeted victims by name, mentioning only the Asian and Western national Olympic Committees, the World Anti-Doping Agency, and the United Nations, along with the Association of Southeast Asian Nations.

But the Operation Shady RAT report does sum up the victims McAfee believes it's found in terms of geo-graphic location and industry or government organization. Out of the 72 targets, 22 are said to be either U.S. federal, state and county agencies or foreign governments, including Canada, South Korea, Vietnam, India, plus the United Nations. The remainder are in construction, energy, high-tech, the news media, defense, real estate and economic think tanks or sports. The report makes an estimate of the intrusion duration in months starting with some in 2006, and the estimated cessation date. Most of the victimized organizations are said to be located in the U.S.

A Washington Post article today on McAfee's Operation Shady RAT report said sources had named the Associated Press offices in New York and Hong Kong as penetrated by the attackers in the past, (the AP said it would not discuss security). But McAfee says it was not the source of that information and would neither confirm nor deny the AP is an organization it has identified.

Alperovitch said the situation McAfee wants to communicate in its report is that "someone is going to a tremendous amount of effort to compromise these computers." He emphasized that that the theft of intellectual property that is occurring represents a "massive transfer of wealth that is happening," as some infiltrator — McAfee will only say it's probably a "nation-state" — effectively siphons off huge amounts of valuable intellectual property.

"This is a massive transfer of wealth that is happening," said Alperovitch, saying it represents an attempt to get an economic advantage by chipping away at an economic advantage others may have. McAfee says it's notified law enforcement and shared its understanding of the situation with the White House and in Congressional briefings.

Read more about wide area network in Network World's Wide Area Network section.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Ellen Messmer

Network World
Topics: McAfee; cyybersecurity, mcafee, security, legal, anti-malware, industry verticals, government, cybercrime
Comments are now closed.

Latest News Articles

Most Popular Articles

Follow Us

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Resources

Best Deals on GoodGearGuide

Compare & Save

Deals powered by WhistleOut
WhistleOut

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?