McAfee gets defensive: Massive cyber attack revelation not being used as a security sales tactic

McAfee today published a report that tells how it discovered evidence in a server on the Internet of stealthy intrusions, probably by an unnamed "nation-state," into 72 businesses and government agencies since 2006. The goal, says McAfee, is to steal massive amounts of confidential information.

More security news: US wants to build cybersecurity protection plan for cars

However, in a conference call with press today, McAfee found itself fending off reporter questions asking whether the company was taking advantage of the situation by using this cache of hacker information in its "Revealed: Operation Shady RAT" to gain new customers. Dmitri Alperovitch, vice president of threat research at McAfee Labs, said McAfee has tried to reach government agencies and businesses it can identify through some evidence to let them know about these hacker intrusions, but rebutted any insinuation that the McAfee research was being used as a sales tool.

"Some IP addresses are very clear, they're the firewall of an organization," said Alperovitch about some of the evidence that McAfee that got from the server logs. McAfee says many businesses and government agencies, especially in the U.S., have been infiltrated. McAfee is still investigating some of the log data it says it obtained "legally" from this server in March, which it had first noticed in 2009 as suspicious. McAfee says this server is one of "hundreds if not thousands" organized to carry out so-called "advanced persistent threats" against organizations. APTs are typically defined as stealthy attacks into networks to get hold of valuable information for purposes of cyber-espionage.

McAfee has gone to some of those organizations it clearly believes have been hit to let them know, Alperovitch said. In one instance, McAfee reached out to the World Anti-Doping Agency in Montreal, though contact was initially misunderstood. McAfee maintains "customer confidentiality agreements" when it shares information with organizations that have been hit by the stealthy attacks aimed at stealing sensitive information, such as intellectual property. Alperovitch said most companies it told about its findings did not want to be publicly named. He adds the server is still out there in operation.

The McAfee 14-page report mentions few of the targeted victims by name, mentioning only the Asian and Western national Olympic Committees, the World Anti-Doping Agency, and the United Nations, along with the Association of Southeast Asian Nations.

But the Operation Shady RAT report does sum up the victims McAfee believes it's found in terms of geo-graphic location and industry or government organization. Out of the 72 targets, 22 are said to be either U.S. federal, state and county agencies or foreign governments, including Canada, South Korea, Vietnam, India, plus the United Nations. The remainder are in construction, energy, high-tech, the news media, defense, real estate and economic think tanks or sports. The report makes an estimate of the intrusion duration in months starting with some in 2006, and the estimated cessation date. Most of the victimized organizations are said to be located in the U.S.

A Washington Post article today on McAfee's Operation Shady RAT report said sources had named the Associated Press offices in New York and Hong Kong as penetrated by the attackers in the past, (the AP said it would not discuss security). But McAfee says it was not the source of that information and would neither confirm nor deny the AP is an organization it has identified.

Alperovitch said the situation McAfee wants to communicate in its report is that "someone is going to a tremendous amount of effort to compromise these computers." He emphasized that that the theft of intellectual property that is occurring represents a "massive transfer of wealth that is happening," as some infiltrator — McAfee will only say it's probably a "nation-state" — effectively siphons off huge amounts of valuable intellectual property.

"This is a massive transfer of wealth that is happening," said Alperovitch, saying it represents an attempt to get an economic advantage by chipping away at an economic advantage others may have. McAfee says it's notified law enforcement and shared its understanding of the situation with the White House and in Congressional briefings.

Read more about wide area network in Network World's Wide Area Network section.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

• Bookmark this page
• Share this article
  •  
  • facebook
  • slashdot
  • digg
  • Reddit
  • stumbleupon
  • linkedin
  • twitter
• Got more on this story? Email CIO
• Follow CIO on twitter

• Share
  Share this article

  •  google+
  • facebookfacebook
  • slashdotslashdot
  • diggdigg
  • RedditReddit
  • stumbleuponstumbleupon
  • linkedinlinkedin
  • twittertwitter
• print
• email
• Bookmark