McAfee gets defensive: Massive cyber attack revelation not being used as a security sales tactic

McAfee today published a report that tells how it discovered evidence in a server on the Internet of stealthy intrusions, probably by an unnamed "nation-state," into 72 businesses and government agencies since 2006. The goal, says McAfee, is to steal massive amounts of confidential information.

More security news: US wants to build cybersecurity protection plan for cars

However, in a conference call with press today, McAfee found itself fending off reporter questions asking whether the company was taking advantage of the situation by using this cache of hacker information in its "Revealed: Operation Shady RAT" to gain new customers. Dmitri Alperovitch, vice president of threat research at McAfee Labs, said McAfee has tried to reach government agencies and businesses it can identify through some evidence to let them know about these hacker intrusions, but rebutted any insinuation that the McAfee research was being used as a sales tool.

"Some IP addresses are very clear, they're the firewall of an organization," said Alperovitch about some of the evidence that McAfee that got from the server logs. McAfee says many businesses and government agencies, especially in the U.S., have been infiltrated. McAfee is still investigating some of the log data it says it obtained "legally" from this server in March, which it had first noticed in 2009 as suspicious. McAfee says this server is one of "hundreds if not thousands" organized to carry out so-called "advanced persistent threats" against organizations. APTs are typically defined as stealthy attacks into networks to get hold of valuable information for purposes of cyber-espionage.

McAfee has gone to some of those organizations it clearly believes have been hit to let them know, Alperovitch said. In one instance, McAfee reached out to the World Anti-Doping Agency in Montreal, though contact was initially misunderstood. McAfee maintains "customer confidentiality agreements" when it shares information with organizations that have been hit by the stealthy attacks aimed at stealing sensitive information, such as intellectual property. Alperovitch said most companies it told about its findings did not want to be publicly named. He adds the server is still out there in operation.

The McAfee 14-page report mentions few of the targeted victims by name, mentioning only the Asian and Western national Olympic Committees, the World Anti-Doping Agency, and the United Nations, along with the Association of Southeast Asian Nations.

But the Operation Shady RAT report does sum up the victims McAfee believes it's found in terms of geo-graphic location and industry or government organization. Out of the 72 targets, 22 are said to be either U.S. federal, state and county agencies or foreign governments, including Canada, South Korea, Vietnam, India, plus the United Nations. The remainder are in construction, energy, high-tech, the news media, defense, real estate and economic think tanks or sports. The report makes an estimate of the intrusion duration in months starting with some in 2006, and the estimated cessation date. Most of the victimized organizations are said to be located in the U.S.

A Washington Post article today on McAfee's Operation Shady RAT report said sources had named the Associated Press offices in New York and Hong Kong as penetrated by the attackers in the past, (the AP said it would not discuss security). But McAfee says it was not the source of that information and would neither confirm nor deny the AP is an organization it has identified.

Alperovitch said the situation McAfee wants to communicate in its report is that "someone is going to a tremendous amount of effort to compromise these computers." He emphasized that that the theft of intellectual property that is occurring represents a "massive transfer of wealth that is happening," as some infiltrator — McAfee will only say it's probably a "nation-state" — effectively siphons off huge amounts of valuable intellectual property.

"This is a massive transfer of wealth that is happening," said Alperovitch, saying it represents an attempt to get an economic advantage by chipping away at an economic advantage others may have. McAfee says it's notified law enforcement and shared its understanding of the situation with the White House and in Congressional briefings.

Read more about wide area network in Network World's Wide Area Network section.

Join the PC World newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags McAfee; cyybersecuritymcafeesecuritylegalgovernmentindustry verticalsanti-malwarecybercrime

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Ellen Messmer

Network World
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?