McAfee’s plan allegedly involved mailing infected Samsung phones to news organizations including International Business Times, Russia Today, and Business Insider, and enlisting the help of “experts” — employees in on the scheme — to “demonstrate” a successful WhatsApp hack. When the phones received messages from personnel on hand, key-logging malware would store and forward them to a remote location. McAfee would then corroborate to the on-hand reporters the content of the messages via a Skype call, making it appear as though the communications were being intercepted.
There’s a bit of a smoking gun: WhatsApp encryption protocol co-designer Moxie Marlinespike told Gizmodo that McAfee confessed to installing malware on the would-be demonstration devices. “Some reporters that had been contacted by McAfee about a demo […] got in touch with me,” he said. “I talked to McAfee on the phone, he reluctantly told me that it was a malware thing with pre-cooked phones, and that all the outlets he’d contacted decided not to cover it after he gave them details about how it’d work.”
When the outlets McAfee contacted began to show disinterest, he reportedly shifted the pitch’s narrative to downplay the hack’s WhatsApp component. In an article published by research firm Cybersecurity Ventures under the headline “WhatsApp message hacked by John McAfee and crew,” McAfee pointed to Google’s Android operating system, not WhatsApp, as the source of the breach that allowed him to read incoming messages surreptitiously. And in a statement provided to Gizmodo, McAfee pushed back against allegations that he attempted to receive press. “Of course the phones had malware on them. How that malware got there is the story, which we will release after speaking with Google,” he said. “It involves a serious flaw in the Android architecture.”
In other words: Rest easy for now, WhatsApp users.
The moral of the story, cybersecurity analyst Dan Guido told Gizmodo, is to view orchestrated demonstrations such as McAfee’s with a highly skeptical eye. “I advised the reporter to go out and buy their own phones,” he said, “because even though they come in a box, it’s very easy to get some saran wrap and a hair dryer to rebox them.”
