McAfee gets defensive: Massive cyber attack revelation not being used as a security sales tactic

03.08.2011
McAfee today published a report that tells how it discovered evidence in a on the Internet of stealthy intrusions, probably by an unnamed "nation-state," into 72 businesses and government agencies since 2006. The goal, says McAfee, is to steal massive amounts of confidential information.

More security news:

However, in a conference call with press today, McAfee found itself fending off reporter questions asking whether the company was taking advantage of the situation by using this cache of hacker information in its "" to gain new customers. Dmitri Alperovitch, vice president of threat research at McAfee Labs, said McAfee has tried to reach government agencies and businesses it can identify through some evidence to let them know about these hacker intrusions, but rebutted any insinuation that the McAfee research was being used as a sales tool.

"Some IP addresses are very clear, they're the firewall of an organization," said Alperovitch about some of the evidence that McAfee that got from the server logs. McAfee says many businesses and government agencies, especially in the U.S., have been infiltrated. McAfee is still investigating some of the log data it says it obtained "legally" from this server in March, which it had first noticed in 2009 as suspicious. McAfee says this server is one of "hundreds if not thousands" organized to carry out so-called "advanced persistent threats" against organizations. are typically defined as stealthy attacks into networks to get hold of valuable information for purposes of cyber-espionage.

McAfee has gone to some of those organizations it clearly believes have been hit to let them know, Alperovitch said. In one instance, McAfee reached out to the World Anti-Doping Agency in Montreal, though contact was initially misunderstood. McAfee maintains "customer confidentiality agreements" when it shares information with organizations that have been hit by the stealthy attacks aimed at stealing sensitive information, such as intellectual property. Alperovitch said most companies it told about its findings did not want to be publicly named. He adds the server is still out there in operation.

The McAfee 14-page report mentions few of the targeted victims by name, mentioning only the Asian and Western national Olympic Committees, the World Anti-Doping Agency, and the United Nations, along with the Association of Southeast Asian Nations.