Slashdot Mirror

According to McAfee you can actually delete it: https://service.mcafee.com/web...

I guess you "need" it because Tizen OS has an app store and like all app stores it sometimes gets malware in it.

Intel are using their mark "McAfee" in trade right now.
http://www.intelsecurity.com/i...
http://www.mcafee.com/
https://www.mcafee.com/consume...

Intel are using their mark "McAfee" in trade right now.
http://www.intelsecurity.com/i...
http://www.mcafee.com/
https://www.mcafee.com/consume...

Anyone that buys McAfee for 3.3 billion is out of their freaking minds.

Anyone who buys McAfee for $44.99 (discounted from $89.99 at the moment) is out of their freaking minds.

Well, the $99 is a small barrier to entry. Considering Cryptowall has garnered nearly a third of a billion dollars, there is probably some good money to be had if an enterprising blackhat can get a working ransomware trojan running on OSX long enough to do the trick. More than enough to justfy several $99 developer registrations.

McAfee (now part of Intel) has something that is pretty innovative:
http://www.mcafee.com/us/solutions/mcafee-deepsafe.aspx

It basically puts AV as the hypervisor beneath the OS.

The real question is if it installs the McAfee, and if it doesn't anybody can point me out where can I get infected?

There is no McAfee anymore. Intel bought them a while back and now they are re-branded Intel Security.
http://www.mcafee.com/us/about...

Reading the whitepaper, the whole thing seems like it's focused on promoting Arxan's services. It's entirely possible that the presentation itself took a different tone/direction, but the whitepaper itself was fairly contentless sprinkled with a few good points about older MITM attacks exploiting the In-App purchases for iOS and the high piracy rates on Android in China and Russia.

Really that last part is the thrust of the article -- high piracy rates for which they don't really offer any solution except DRM and always-online games. (To their credit, they do make the recommendation of "some sort of protection on the networking layer, in-memory layer, and on disk layer...as well as portions dealing with receiving and unpacking the player's saved game or state.")

Everything else was either misleading, fairly obvious non-suggestions, or just plain outdated information.

Examples:

- Whitepaper dedicates a section to lost revenue from a MITM attack allowing iOS users to get in-app purchases for free. The reference they use is a 2012 article from the Guardian talking about how Apple already fixed it. Specifically, this was relating to iOS 5 and has since been resolved. While Jailbreak options still exist, the whitepaper does not mention these nor does it discuss any other actual leak.Referenced Article

- Whitepaper has section on Flappybird clones which reads:

...However, by March 2014, approximately 60 Flappy Bird clones a day were being added to the iOS App Store...Worst of all -- a reported 79% of these clones contained malware.

This section has a reference that points to a McAfee threat report from June 2014 - as the section reads, "these" refers to the clones on the iOS App Store, however, the McAfee report clearly shows that this is Android stores that are plagued, not iOS. http://www.mcafee.com/us/resou... Page 6

- Whitepaper has a section on how hackers damage communities, which is not incorrect, however, they provide the following "helpful" tips:

• Learn how to tell when a hacker hacks
• Include banning as a feature
• Look for reports of hacking

While these are not bad suggestions, they're also absolutely common sense for mobile game developers, or just people dealing with problems in general.

The submitter is absolutely right that this could have been a really keen presentation, but based on what they produced in the whitepaper, it sounds like a business trying to drum up some more business for themselves with misleading and/or useless information.

They CAN function as decent indicators (provided this isn't some "brand new" site they haven't tested):

http://safeweb.norton.com/buzz
http://www.siteadvisor.com/
http://wepawet.iseclab.org/
http://www.mywot.com/en/commun...
http://www.virustotal.com/
http://www.mcafee.com/us/mcafe...
http://www.malwareurl.com/list...
http://cbl.abuseat.org/lookup....
http://www.threatstop.com/chec...
http://www.avgthreatlabs.com/s...

* You can run sites OR IP Addresses thru them to check *ANY* sites you wish that you're unsure of... enjoy!

APK

P.S.=> In fact, I built hooks into those into this application of mine (in its "Site Checkers" menu, pictured below) that allows users of my APK Hosts File Engine 9.0++ 32/84-bit-> http://start64.com/index.php?o... to answer the SAME basic question you have - in case they wish to remove any sites blocked in the hosts file data imported, these sites give them a FAR MORE DECENT INDICATOR than mere "word-of-mouth"... apk

To deal with just one piece of your drivel.

Your M$-xx and iOS-xx are easy targets for malware, and that is a fact, not so much on my side of the fence.

Virtually all mobile malware is for Linux (Android). None of it in 2013 was for iOS, and precious little in any preceding year.

http://www.mcafee.com/uk/secur...

Did _you_ know that your wireless router was using OpenSSL to manage EAP? Or did you just assume that having SSH blocked and not serving HTTPS would be enough?

And even if you did, is it even possible for you to upgrade a single library on your access point?

Try going back to the original CVE, the plethora of vulnerability checkers, or any of the press surrounding it. Every reference to Heartbleed pointed to HTTPS or, rarely, TLS and VPN services as being vulnerable to the bug. Now pretend that you don't know the implementation details of WPA and EAP. Based on all of that, why would you even consider updating or replacing every wireless device you have which don't use HTTPS unless the manufacturer told you?

Moreover, when have manufacturers of popular wireless equipment _ever_ produced timely and relevant updates without at least eight months lead time and court cases in at least three countries?

Did _you_ know that your wireless router was using OpenSSL to manage EAP? Or did you just assume that having SSH blocked and not serving HTTPS would be enough?

And even if you did, is it even possible for you to upgrade a single library on your access point?

Try going back to the original CVE, the plethora of vulnerability checkers, or any of the press surrounding it. Every reference to Heartbleed pointed to HTTPS or, rarely, TLS and VPN services as being vulnerable to the bug. Now pretend that you don't know the implementation details of WPA and EAP. Based on all of that, why would you even consider updating or replacing every wireless device you have which don't use HTTPS unless the manufacturer told you?

Moreover, when have manufacturers of popular wireless equipment _ever_ produced timely and relevant updates without at least eight months lead time and court cases in at least three countries?

Other Anti-Virus vendors like Symantec, McAfee, and Kaspersky are going to continue to support XP past April, so why should Microsoft concede market share to these competitors?

Also, Microsoft is going to look pretty bad if a new virus makes a major impact, so having their security product database updates continue will mitigate that. Doing otherwise could easily be spun as irresponsible.

I can't think of anyone I know who would ever claim their environment was secure, whether I've worked Wall Street, health insurance, defense contractors or any other type of organization that might be typically portrayed as secure. All of these environments have professionals, and all of them are painfully aware of the holes in the system and would fix them if they had the resources. The hard reality is that security costs money and good security costs even more money. Security also has a habit of impeding functionality and in today's environment, this is considered a big deal.

Security is really all about risk management and balancing any given risk against it's likelihood, cost of cleanup and cost of prevention. You can white-list every website your staff are allowed to visit on the Internet and dramatically reduce the number of infected machines, but the cost in terms of staffing, employee morale and retention would be quite high. You can put man traps at every door in your facility, however it would be a foolish waste of money and irritation in 99% of use cases.

Like it or not security is often tied directly to regulatory and compliance requirements. Those environments that have some sort of regulatory and compliance requirement are typically far more secure than those that don't. If you want improved security for the country (wherever your country is) you have to start with regulations and compliance requirements that force companies to institute it to begin with. It's claimed that cybercrime costs $100 billion in the US and $400 billion per year.

Want better security? Get companies to realize that have poor security costs more money than good security.

You mean like this?

http://www.mcafee.com/us/products/application-control.aspx

As a web developer, let me say that none of the stuff you mention really matters when it comes to tracking you around the web. In fact, most of it is pretty essential in making your experience on a site a good one.

What does matter is that sites totally unrelated to google, facebook, twitter, etc, are embedding scripts and iframes from those sites on their own pages. When you see that facebook like button beside Dr. Pink's Anal Brightening, facebook knows you're there. If you click the like button, then facebook tells all your friends you were there. This is the faustian bargain that facebook offers to third parties... Let facebook follow your users and facebook will spam its users with your sites offers.

Nobody even questions it. Facebook likes and google analytics are considered essential elements of every website by management types. They have no idea what a <link> tag is or how it can impact the site's security, but they **know** that you better have google analytics! (If you like being employeed)

I notice Schneier failed to mention the EU cookie law. Unlike in the US, the EU is actually serious about fixing the problem. Essentially, if you care about this sort of spying and you go to any site that provides the required EU notice, just leave and don't go back. All the legit methods of first party tracking are exempt. Session cookies are exempt as well as first party analytics cookies. That notice is telling you that facebook, google, and any number of other third parties are tracking your activity on the site.

http://www.mcafee.com/us/downloads/free-tools/index.aspx

"McAfee is committed to your security and provides an assortment of free McAfee tools to help in your software development. Simply select a tool and download it for free."

You may remember most of these tools as coming from Foundstone:

https://en.wikipedia.org/wiki/Foundstone

"Foundstone is a practice within McAfee Professional Services that provides tactical and strategic computer security services."

"Although Foundstone is owned by McAfee, it stays vendor neutral in order to remain impartial in its services."

Yeah, that would be a little late. It's been around for a very long time now.

http://www.mcafee.com/us/products/virusscan-enterprise-for-linux.aspx

The problems that Windows has are a Windows problem. They aren't shared by anyone else. Even the problems that Android has are down to bad apps masquerading as good ones and aren't the self-replicating and browse-by infections that you can get with Windows.

Windows is the only cesspool. It's about Microsoft engineering, not popularity.

Wow, that's some serious blinders you've got on, you've obviously got a religious attachment to some Microsoft hate that makes you spew out rubbish like that. The sort of thing that keeps you ignorant of things like jailbreakme.com, linux rootkits, OSF.8759, Slapper, Scalper, Linux.Svat and L10n among many, many, many others. You're just a clear ignorant fanboy.

You probably don't think of your car as a developer platform

Sadly, you might soon have to, in the sense that you'll need to [pdf] keep your security patches up to date...

...and computer security was published in a recent report from the European Network and Information Security Agency indicating that banks should always assume their client computers are infected.
I started moving the PC's I "maintain" (parents etc.) away from Windows and to a separate Ubuntu partition *only* for banking for this very reason. The likelihood that that partition is vulnerable (different OS, no other internet tooling running on it) is significantly lower.
At the same time, banks start drawing lines on what they do and do not reimburse to their clients based on e.g. their computers' security state and their client's intellect (giving out pin codes to perfect strangers...). While the latter is quite logical, the former is starting to become an issue: some banks insist that clients (especially business clients) did not take enough precautions against an attack. Of course not all attacks can be prevented in the first place, as TFA indicates. So, better be safe(r) than sorry and protect your banking as much as you can. (Situation is from The Netherlands BTW, with ABN Amro and Rabobank as some of the examples of banks that start questioning their clients security behaviour, positively or negatively).

ummary Exploit:AndroidOS/GingerBreak is a trojan that affects mobile devices running the Android operating system. It drops and executes another trojan detected as Exploit:AndroidOS/CVE-2011-1823, which, if run successfully, gains administrator privileges on the device. http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Exploit%3AAndroidOS%2FGingerBreak

I only see one publicly visible spam volume graph supporting this claim: SpamHaus CBL (look at the "Last quarter" graph).

SpamCop and SenderBase suggest the overall trend is still down, though I'm not convinced this is related to Grum -- it appears Grum just wasn't as major a player as people thought.

The other graphs I have bookmarked, from McAfee (click the "Historic Data" tab) and Symantec, are inconclusive.

Don't know what exactly your requirements are, but you can look into McAfee EMM, supports iOS, Android, Windows Phones and Blackberry

http://www.mcafee.com/us/products/enterprise-mobility-management.aspx

Disclaimer: I work for McAfee but a different division

The DoD employs something called "HBSS" - Host Based Security System - which is in reality McAfee's "e Policy Orchestrator" (ePO) plus a bunch of modules that plug in to ePO. One of the ePO modules is a data loss prevention agent that was pushed out to the client endpoint that prevented anything other than USB HID devices from functioning

https://kc.mcafee.com/corporate/index?page=content&id=KB60861 looks like an accurate description of what was done with HBSS policies.

SSH can't be proxied like SSL traffic

yep, it can. there are a few commercial fw's that do it...check out page 191 of McAfee's (.pdf) userguide
here

if you don't wanna read the .pdf...check here

"Put the network firewall in charge of security again with integrated comprehensive network gateway protection technology, including:

        Encrypted traffic inspection (SSH/SSL)
"

SSH can't be proxied like SSL traffic

yep, it can. there are a few commercial fw's that do it...check out page 191 of McAfee's (.pdf) userguide
here

if you don't wanna read the .pdf...check here

"Put the network firewall in charge of security again with integrated comprehensive network gateway protection technology, including:

        Encrypted traffic inspection (SSH/SSL)
"

Take a look at page 10 of this report; http://www.mcafee.com/us/resources/reports/rp-quarterly-threat-q1-2012.pdf. The number of new malware programs has almost tripled in 3 years. It is true the numbers are far from the Windows numbers but then so is the installation base and the OSX numbers are far from one or two..

Total spam volume continues to increase in spite of filtering, which indicates it has not had any meaningful effect on the rewards for the spammer

[citation needed]

Counter data: McAfee Quarterly Report 2011Q3

http://downloadcenter.mcafee.com/products/evaluation/VCL/AIX/Readme_VCL_UNIX.txt

McAfee offers a removal tool to cleanly uninstall their products. I use it any time I clean up a system: http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

The original McAfee blog article says this (why not link to the original resource in the first place?):

However, we’ve seen only the PC version in a downloader/dropper in the wild.

So this is not different at all from the Java-based Facebook suicide Trojan horse which circulated in Spring 2010 (but was not spotted by most AV companies back then).

I'm not even going to bother linking all of these...

http://www.mcafee.com/us/products/virusscan-enterprise-for-linux.aspx
http://us.trendmicro.com/us/products/enterprise/serverprotect-for-linux/
http://www.kaspersky.com/linux
http://www.eset.eu/products/nod32-for-linux
http://www.centralcommand.com/Products/VexiraforLinux/VexiraforLinuxFileserver.aspx http://www.centralcommand.com/Products/VexiraforLinux/VexiraforLinuxSambaServer.aspx
http://www.centralcommand.com/Products/VexiraforMailServers.aspx
http://www.f-prot.com/download/home_user/download_fplinux.html
http://www.avast.com/linux-home-edition
http://www.avast.com/linux-unix-edition
http://www.sophos.com/en-us/products/endpoint/endpoint-security-and-data-protection/components/anti-virus-protection/linux.aspx?utm_source=Non-campaign&utm_medium=AdWords&utm_campaign=NA-AW-Linux
http://www.ca.com/us/Support/gsa/Virus-Info/Virus-Signature-Updates/eTrust-Antivirus-7x-for-UNIX-and-Linux.aspx
http://www.pandasecurity.com/homeusers/downloads/desktopsecure/
http://www.pandasecurity.com/enterprise/solutions/
http://www.pandasecurity.com/enterprise/solutions/commandline/
http://free.avg.com/us-en/download.prd-alf
http://download.bitdefender.com/repos/

NERC, in charge of all the power regulations in the US under FERC, requires A/V as well in CIP-007 R4. In fact, it is required for anything that is "cyber" (which means anything with an IP address). Got a networked printer, switch, router, firewall which cannot have A/V? Get ready to file a bunch of paperwork (known as a TFE), yearly, and prove that the vendor says you cannot get A/V for it. Better to install a dumb unmanaged switch or non-networked printer (share it via a workstation) so you can avoid paperwork.

McAfee VirusScan Enterprise for Linux works on RHEL5.5. However, McAfee recommends not running it on RHEL5.6 (although our testing has found no problems and we're not using NFS in our NERC areas, but we'd be officially unsupported by McAfee). It will not work on RHEL6 or any of the newer Fedora 13+ releases.

Don't go off the beaten trail and expect support either. Oracle Enterprise Linux is based significantly on RHEL, but yet McAfee won't support OEL.

I'm not sure what all the requirements are some folks may have, but I use ClamAV just so I can say I have some A/V on my desktop and laptop and so I can scan USB devices that others may ask me to check.

NERC, in charge of all the power regulations in the US under FERC, requires A/V as well in CIP-007 R4. In fact, it is required for anything that is "cyber" (which means anything with an IP address). Got a networked printer, switch, router, firewall which cannot have A/V? Get ready to file a bunch of paperwork (known as a TFE), yearly, and prove that the vendor says you cannot get A/V for it. Better to install a dumb unmanaged switch or non-networked printer (share it via a workstation) so you can avoid paperwork.

McAfee VirusScan Enterprise for Linux works on RHEL5.5. However, McAfee recommends not running it on RHEL5.6 (although our testing has found no problems and we're not using NFS in our NERC areas, but we'd be officially unsupported by McAfee). It will not work on RHEL6 or any of the newer Fedora 13+ releases.

Don't go off the beaten trail and expect support either. Oracle Enterprise Linux is based significantly on RHEL, but yet McAfee won't support OEL.

I'm not sure what all the requirements are some folks may have, but I use ClamAV just so I can say I have some A/V on my desktop and laptop and so I can scan USB devices that others may ask me to check.

NERC, in charge of all the power regulations in the US under FERC, requires A/V as well in CIP-007 R4. In fact, it is required for anything that is "cyber" (which means anything with an IP address). Got a networked printer, switch, router, firewall which cannot have A/V? Get ready to file a bunch of paperwork (known as a TFE), yearly, and prove that the vendor says you cannot get A/V for it. Better to install a dumb unmanaged switch or non-networked printer (share it via a workstation) so you can avoid paperwork.

McAfee VirusScan Enterprise for Linux works on RHEL5.5. However, McAfee recommends not running it on RHEL5.6 (although our testing has found no problems and we're not using NFS in our NERC areas, but we'd be officially unsupported by McAfee). It will not work on RHEL6 or any of the newer Fedora 13+ releases.

Don't go off the beaten trail and expect support either. Oracle Enterprise Linux is based significantly on RHEL, but yet McAfee won't support OEL.

I'm not sure what all the requirements are some folks may have, but I use ClamAV just so I can say I have some A/V on my desktop and laptop and so I can scan USB devices that others may ask me to check.

Well that doesn't really fall under the FBI mandate first of all, and second of all it is somewhat irrelevant, as the vast majority of affected computers are U.S. connected either in country or in territories/military facilities: http://www.mcafee.com/threat-intelligence/malware/default.aspx?id=100313 (note that the link is to the trojan that installs the backdoor they are removing, but as this infection is a prerequisite in most cases, it should be a good indicator of infection levels.)

i wouldn't be surprised to find that linux actually outnumbers windows quite considerably

WOW. Live in your own little make believe world do you?

Supercomputers - 80-90% running linux is still high, but seriously, it's easier to grab computing cycles from many desktop computers, turning them into a "supercomputer" with more computing power than all the top500 supercomputers combined than trying to infect one and keep it infected while you steal all those cpu cycles.
Linux servers get hacked all the time, but you would know that if you actually ran one. See: http://www.chkrootkit.org/
Phones get malware: http://mobile.slashdot.org/story/11/03/06/202208/Google-Finally-Uses-Remote-Kill-Switch-On-Malware?from=rss
Embedded Linux: Nope, not safe here either: http://www.mcafee.com/threat-intelligence/malware/default.aspx?id=154392

McAfee is second only to Norton in the amount of effort required to remove it, and the resources it hogs.

MCPR.exe hasn't failed for me yet. That said, with regards to resource hogging -- I'll give you that. One of the many reasons we have switched to Sophos at work. 50 PCs now running Sophos -- we're never looking back.

In a perfect world, we'd be running some kind of Unix that doesn't encourage you to run as root all day long, but until that day arrives, we're stuck with supporting those that haven't yet made the switch.

Still waiting for the first Mac OS X virus in the wild...

McAfee lists 48 known "viruses" for OSX. Most appear to be Trojans giving remote access or subverting DNS. I perused a few of the McAfee descriptions, and it was not immediately clear whether these infections would be self-propagating (as one would ordinarily expect of viruses). Just like other *nix threats, they require the user to actively run the infecting program and enter a privilege-escalating password.
While not a Mac user or fan (Linux user, mostly), I am also mystified by the characterization of OSX as being less secure then Windows. Even turning to social engineering as a security hole, it's not certain that Mac users would be easier to subborn than Windows users.

They already (sadly) make it: http://blogs.mcafee.com/enterprise/mobile/mcafee-for-android-a-mobile-security-update

Honestly though I'm tired of Lookout Mobile doing this fear mongering. I'll give them credit though, they are smart guys -- and based on their defcon presentation, they know a lot about Android sercurity. But stop with the scare tactic PR news stories. This would be akin to saying "Virus found on The Pirate Bay, news at 11." I know they need PR because they are a startup, but c'mon.

Only people that are not familiar with any of their service offerings or other products. Have a look at their business products page. http://www.mcafee.com/us/products-solutions.aspx

I like truecrypt and MSE for windows systems myself but I am not an IT director.

And - you still can!

As of April 1, 2010, SCAN.EXE is defunct and has been replaced by a stub file. https://kc.mcafee.com/corporate/index?page=content&id=KB68671

McAfee (one f). :P

Considering that this government already attacked critical websites using a DDOS attack, it's not out of the question for them to attempt something like Green Dam.

Who is McAffee? I have heard of McAfee though. :P

Speaking as someone who spent over a decade as an anti-virus researcher and anti-virus engine developer, the truth is that it is infeasible for AV companies to keep up with the flood of (generated) malware that engulfs modern PCs... and, believe me, it's not for lack of trying.

Why spend 10 years trying to identify all the "bad" code when it should be far easier to identify the apps that you want to allow to run on your machine?

http://www.mcafee.com/us/about/corporate/mcafee_Solidcore.html

Here's an online version of their EULA: http://home.mcafee.com/Root/AboutUs.aspx?id=eula Of course there's a limited liability clause: Limitation of Liability UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, WHETHER IN TORT, CONTRACT, OR OTHERWISE, SHALL MCAFEE, OR ITS AUTHORIZED PARTNERS OR SUPPLIERS BE LIABLE TO YOU OR TO ANY OTHER PERSON FOR LOSS OF PROFITS, LOSS OF GOODWILL, OR ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, OR DAMAGES FOR NEGLIGENCE OF ANY CHARACTER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL, WORK STOPPAGE, LOSS OF DATA, COMPUTER FAILURE OR MALFUNCTION, OR FOR ANY OTHER DAMAGE OR LOSS. IN NO EVENT SHALL MCAFEE, OR ITS AUTHORIZED PARTNERS OR SUPPLIERS BE LIABLE FOR ANY DAMAGES IN EXCESS OF THE PRICE PAID FOR THE SOFTWARE, IF ANY, EVEN IF MCAFEE, OR ITS AUTHORIZED PARTNERS OR SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. This limitation shall not apply to liability for death or personal injury to the extent that applicable law prohibits such limitation. Furthermore, some jurisdictions do not allow the exclusion or limitation of incidental or consequential damages, so this limitation and exclusion may not apply to you. Nothing contained in this Agreement limits McAfees liability to you for McAfees gross negligence or for the tort of fraud. McAfee is acting on behalf of its suppliers and Authorized Partners for the purpose of disclaiming, excluding and/or limiting obligations, warranties and liability as provided in this Agreement, but in no other respects and for no other purpose. The foregoing provisions shall be enforceable to the maximum extent permitted by applicable law. And under warranties: Warranty Disclaimer. Except for the limited warranty set forth herein, THE SOFTWARE IS PROVIDED "AS IS" AND McAfee MAKES NO WARRANTY AS TO ITS USE OR PERFORMANCE. EXCEPT FOR ANY WARRANTY, CONDITION, REPRESENTATION OR TERM THE EXTENT TO WHICH CANNOT BE EXCLUDED OR LIMITED BY APPLICABLE LAW, (The warranty they give is basically just for defective install media). It's rather telling if you look at the selling points on their website, and then look at the EULA.... I understand that most places have EULA's like this now, but they aren't standing behind their product when it comes down to it one bit.

There's a summary and apology now on their site and it's linked from the front page (albeit not in huge letters). I'm not saying this is good enough, just providing an update.