The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/pc/virus/mcafee.nws

Text File | 2003-06-11 | 13.4 KB | 215 lines

     (NOTE: The following article was published as a whole in the
April 5, 1992 edition of New York Newsday, page 68.  It is reprinted
below without the express consent of Joshua Quittner, New York Newsday,
or the Times-Mirror Company)

[Moderator's note: Hot off the FAX, a correction to the above - this
article is reprinted below WITH permission as follows: "A Newsday
article reprinted by permission.  Newsday, Inc., Copyright, 1992."  My
thanks to Joseph for doing the groundwork and for typing this article
in and to Newsday.]

                        SOFTWARE HARD SELL
                        ------------------
          "Are computer viruses running rampant, or is
           John McAfee's antivirus campaign running amok?"
                                 -By Joshua Quittner, staff writer

    John McAfee is doing one of the things he does best: warning a
reporter about the perils of a new computer virus.
    "We're into the next major nightmare -- the Dark Avenger Mutating
Engine," McAfee says, ever calm in the face of calamity.  "It can
attach to any virus and make it mutate."  The ability to "mutate"
makes it virtually undetectable to antivirus software, he explains.
    "It's turning the virus world upside down."
    But wait.  This is John David McAfee, the man who once ran a service
that revolved around the curious premise that, if you paid him a member-
ship fee and tested HIV-negative, you could have AIDS-free sex with other
members for six months.  This is the man who jumped from biological
viruses to computer viruses and quickly became a flamboyant expert on the
new demi-plague, showing up at the scene of infected PCs in his Winnebago
"antivirus paramedic unit."
     And this is the same man who started something called the Computer
Virus Industry Association, and, as chairman, made national headlines
last month by saying that as many as _five million_ computers might be
infected with a virus named Michelangelo.
     The virus turned out to be a dud, in the opinion of many industry
experts.  But not before McAfee became a media magnet: In the weeks be-
fore March 6, when Michelangelo was supposed to erase the hard disks of
infected IBM and compatible PCs, he was featured by Reuters, the
Associated Press, USA Today, the Wall Street Journal, "MacNeil/Lehrer
News Hour," CNN, "Nightline," National Public Radio and "Today."
     What some news reports failed to point out, however, is that McAfee
is also the man who runs Santa Clara, Calif.-based McAfee Associates,
a leading manufacturer of antivirus software, and that he stood to
benefit from publicity about Michelangelo.  McAfee won't reveal sales,
but it seems clear they shot up during the two-week frenzy.
     "People kept saying I hyped this, I hyped this," said McAfee, who
still defends the notion that Michelangelo was widespread.  "I never
contacted the press -- they called me."
     McAfee's detractors say the Michelangelo scare was mainly hype and
media manipulation, a parade in which most of the floats were built by
McAfee.  They say McAfee helped drive the rush to buy antivirus soft-
ware -- with his products poised to sell the most -- while boosting the
profile of McAfee Associates, a company that recently received
$10 million from venture capitalists McAfee says are waiting to sell
stock publicly.
     And, critics say, while McAfee touts a recent evaluation that rated
his software alone as 100 percent effective in finding virtually every
known virus, he funded the evaluation and picked his competitors.
     "He does know the issue of viruses, no doubt about it," said Ken
Wasch, executive director of the 900-member Software Publishers Assoc-
iation.  "But his tactics are designed to sell _his_ software."
     McAfee says the media consistently misquoted him about how
widespread Michelangelo was.  And his company didn't profit from the
virus, he says, but actually suffered due to the free advice his staff
was dispensing.  "It does not benefit me in any way or shape or form
to exaggerate the virus problem."
    Even McAfee's detractors admit his programs do what they're supposed
to do: track down coding that's maliciously placed in software to make it
do anything from whistle "Yankee Doodle" to erase valuable data.
    His strongest distribution channel is shareware, a kind of software
honor system common on electronic bulletin boards.  PC users can download
the programs over phone lines and pay later if they find them useful.
    McAfee's programs are "probably the most popular shareware programs
of all time, second only to PKZIP," which compresses data, said George
Pulido, technical editor of Shareware Magazine.  He said McAfee's
programs have been copied by millions of people, although only about 10
percent of shareware users actually pay.
    A more reliable money-maker is corporate site licenses, where McAfee
is one of the three biggest players.  Michael Schirf, sales manager of
Jetic Inc., a Vienna, Va., company that is McAfee's sales agent for the
Mid-Atlantic region, claimed more than 300 of the Fortune 500 companies
have licensed his software, paying $3,250 to $20,000, depending on the
number of PCs.  During the Michelangelo scare, "you couldn't get through
to us at one point because of people asking about it and trying to get
it," Schirf said.
    Certainly, McAfee's software wasn't the only antivirus software
selling.  Fueled by giveaways of "special edition" programs that scanned
exclusively for the Michelangelo virus, sales of general antivirus
packages were a bonanza for everyone in the business, including Norton/
Symantec and Central Point Software, two other leading sellers.
    "Our sales of antivirus software were up 3,000 percent," said Tamese
Gribble, a spokesman for Egghead Software, the largest discount software
retailer in the country.  "We were absolutely swamped."
    Rod Turner, a Norton executive vice president, said antivirus sales
increased fivefold.  "We didn't make any product in advance," he said,
"so we were caught with our pants down."  Companies like Norton that
sell factory-shipped software couldn't ramp up quickly enough to take
full advantage of the situation.  But McAfee's software comes mostly
through electronic bulletin boards and sales agents, giving him a nearly
limitless capability to meet demand.  "I can supply as many copies of the
software as I have blank diskettes to put it on," Schirf said.
    The Michelangelo scare was also good for pay-by-the-hour on-line
information services such as Compuserve, which saw a huge increase in the
time users logged on looking for advice on Michelangelo.
    Indeed, a virus forum on Compuserve was hugely popular, with users
downloading antivirus programs, including McAfee's, 49,000 times that
week, Compuserve spokesman Dave Kishler said.  Compuserve made more than
$100,000 from the online time.
    McAfee makes an attractive industry spokesman.  Tall and lean, with a
mellifluous voice, he speaks in perfect sound bites -- an antidote to the
unquotably bland men who otherwise dominate the antivirus business.
    A mathematician who got into programming when he graduated from
Roanoke College, McAfee, 47, said he has held a dozen jobs, ranging from
work on a voice-recognition board for PCs to consulting for the Brazilian
national phone company in Rio de Janeiro.  His first mention in the media
was in connection with the American Association for Safe Sex Practices, a
Santa Clara club formed so that its members could engage in AIDS-free
sex.  For a $22 fee, members whose blood tested HIV-negative were given
cards certifying them AIDS-free, buttons saying "Play it Safe," and were
entered on McAfee's on-line data base.  Updates, every six months, cost
$7.
    Anyone who knows anything about AIDS knows a certificate that someone
is AIDS-free is good only until the person has sex with or shares an
intravenous needle with an infected person.
    When asked now about the safe-sex group, McAfee at first denied
anything but a passing affiliation: "I worked for those people as a con-
tractor," he said, adding, "It was not my company."  But later, when he
was reminded that both the San Diego Tribune and the San Francisco
Chronicle described him in feature stories as the entrepreneur who
started the organization ("I believe I am providing an environment
where people who are sexually active can feel more safe and secure,"
he told the Tribune in a March 9, 1987, story), McAfee sidestepped the
ownership question.  He said the group performed a valuable function,
maintaining a data base on AIDS and information about the disease.
    "I thought they were pretty well ahead of their time," he said,
quickly locating a 1987 newsletter put out by the group, which featured
articles such as "Kissing and AIDS" and "The Apparent Racial Bias of the
AIDS Virus."
    The association no longer exists.  "They came and went pretty fast,"
McAfee said, chuckling.
    McAfee got his first taste of computer viruses at around that time.
"It was an accident, like anything else in life," he recalled.  "I got
a copy of the Pakistani Brain.  I think I got it from one of the local
colleges.  It was the program of the year."  The program, reportedly
written by two Pakistani students trying to foil software pirates,
destroyed some PC data.
    By 1989, McAfee was a virus expert, selling the first antivirus
software and offering to make house calls with his Winnebago cum computer
lab.
    "John's antivirus unit is the first specially customized unit to wage
effective, on-the-spot counterattacks in the virus war," McAfee and a
co-author reported in "Computer Viruses, Worms, Data Diddlers, Killer
Programs, and Other Threats to Your System," their 1989 book.  "Event-
ually, there will be many such mobile search, capture and destroy anti-
virus paramedic units deployed around the world."
    He had also founded the Computer Virus Industry Association, with
himself as chairman.
    "The CVIA is nothing more than McAfee," said Wasch, of the Software
Publishers Association.  "I had a run-in with him three years ago about
that."  Wasch said he had been asked by other antivirus businesses to
look into McAfee's group after claims surfaced that he was railroading
companies into joining -- something McAfee vigorously denies.  Wasch
said he believes the assocation was a self-serving group that did
little more than support McAfee's business.
    "It would be like Microsoft creating the Windows Support Association
as a front to promote its Windows software," Wasch said.
    McAfee denies the CVIA is a front and said Wasch's group was
threatened by the creation of the virus association.  "They wanted to
take us over," he said.  In any event, he said, the association is now
managed by others and his involvement is minimal, adding, "It's more of
a nuisance to me."  But he does say the association is dependent on his
private business for much of its virus data.  "McAfee Associates has all
the numbers," he said.
    Detractors say McAfee now uses another association to hype his
programs.
    The National Computer Security Association released one of the few
ratings of antivirus software, with McAfee's program on top -- a
comparison he's quick to cite.  But that may be because he influenced
which software would be compared with his and how the tests were run,
said David Stang, who founded the for-profit association in Washington,
D.C., two years ago.  Stang recently left the association and started
a new one after a falling-out with McAfee over testing procedures.
    Stang said one of the assocation's functions was to "certify"
antivirus software -- to test and rate competing programs.  "It was his
[McAfee's] idea that we certify products," Stang said.  And when no
company rushed forward to pay $500 to have its software rated, McAfee
"sent me the products and the check and said 'go certify.'"
    McAfee says he spent thousands of dollars to evaluate some of his
competitors' programs.  In February, 1992, in fact, he paid for his own
and the other five programs to be certified.  His was ranked 100 percent
effective.  The others ranged from 44 percent to 88 percent effective.
    "If your product competes with mine, I'd like for those customers of
mine to know that your product isn't as good as mine," he said.  But in
the February certification, notably absent were McAfee's biggest
competitors: Dr. Solomon's ToolKit and Skulason's F-Prot.
    "I've got 75 competitors.  I pick the ones who are going to give me
the most trouble that month," McAfee explained.
    The February evaluation was actually a second, and more favorable
test, that Stang says he performed at McAfee's request.  Stang said
McAfee was dissatisfied with the assocation's methods -- it tested the
software against a "library" of viruses that McAfee thought wasn't
comprehensive enough.  So Stang said he agreed to use a new library that
he claims was built on viruses McAfee found and supplied.  Scores for
McAfee's program rose while some others dropped sharply.  McAfee said
Stang's virus library was incomplete and his testing methods "wishy-
washy," and he defended the new library's independence.
    "This is not something that anybody, let alone me, could mess with,"
said McAfee.  "You can't jimmy these scores.  You can't say that McAfee
buys more certifications, therefore he'll get a better score, because
other vendors would complain."
    "They wouldn't let me get away with it."