Skip Links

McAfee gets defensive: Massive cyber attack revelation not being used as a security sales tactic

McAfee Labs says goal of report is to show enormity of world-wide security threat

By , Network World
August 03, 2011 04:53 PM ET

Network World - McAfee today published a report that tells how it discovered evidence in a server on the Internet of stealthy intrusions, probably by an unnamed "nation-state," into 72 businesses and government agencies since 2006. The goal, says McAfee, is to steal massive amounts of confidential information.

More security news: US wants to build cybersecurity protection plan for cars

However, in a conference call with press today, McAfee found itself fending off reporter questions asking whether the company was taking advantage of the situation by using this cache of hacker information in its "Revealed: Operation Shady RAT" to gain new customers. Dmitri Alperovitch, vice president of threat research at McAfee Labs, said McAfee has tried to reach government agencies and businesses it can identify through some evidence to let them know about these hacker intrusions, but rebutted any insinuation that the McAfee research was being used as a sales tool.

"Some IP addresses are very clear, they're the firewall of an organization," said Alperovitch about some of the evidence that McAfee that got from the server logs. McAfee says many businesses and government agencies, especially in the U.S., have been infiltrated. McAfee is still investigating some of the log data it says it obtained "legally" from this server in March, which it had first noticed in 2009 as suspicious. McAfee says this server is one of "hundreds if not thousands" organized to carry out so-called "advanced persistent threats" against organizations. APTs are typically defined as stealthy attacks into networks to get hold of valuable information for purposes of cyber-espionage.

McAfee has gone to some of those organizations it clearly believes have been hit to let them know, Alperovitch said. In one instance, McAfee reached out to the World Anti-Doping Agency in Montreal, though contact was initially misunderstood. McAfee maintains "customer confidentiality agreements" when it shares information with organizations that have been hit by the stealthy attacks aimed at stealing sensitive information, such as intellectual property. Alperovitch said most companies it told about its findings did not want to be publicly named. He adds the server is still out there in operation.

The McAfee 14-page report mentions few of the targeted victims by name, mentioning only the Asian and Western national Olympic Committees, the World Anti-Doping Agency, and the United Nations, along with the Association of Southeast Asian Nations.

But the Operation Shady RAT report does sum up the victims McAfee believes it's found in terms of geo-graphic location and industry or government organization. Out of the 72 targets, 22 are said to be either U.S. federal, state and county agencies or foreign governments, including Canada, South Korea, Vietnam, India, plus the United Nations. The remainder are in construction, energy, high-tech, the news media, defense, real estate and economic think tanks or sports. The report makes an estimate of the intrusion duration in months starting with some in 2006, and the estimated cessation date. Most of the victimized organizations are said to be located in the U.S.

Our Commenting Policies
Latest News
rssRss Feed
View more Latest News