Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Security Vendor McAfee to Pay $50 Million Fine

Posted by Zonk on Thu Jan 05, 2006 10:56 AM
from the do-the-crime-pay-the-fine dept.
goombah99 writes "RedHerring.com reports that Security Vendor McAfee has agreed to pay a fine of fifty million dollars stemming from false SEC filing. McAfee cooked its books, overstating its revenues one year by 131%, or half a billion dollars. The method employed was 'channel stuffing' in which compliant re-sellers are effectively paid to buy and hold inventory they may never sell. The shipped goods are booked as revenue and the payments disguised in the books. When it caught up with them, McAfee's stock price crashed, wiping out a billion dollars of shareholder capitalization. The story quotes an analyst saying this maybe the swan song for the once dominant vendor."
+ -
story

Related Stories

[+] McAfee Anti-Virus Causes Widespread File Damage 353 comments
AJ Mexico writes, "[Friday] McAfee released an anti-virus update that contained an anomaly in the DAT file that caused many important files to be deleted from affected systems. At my company, tens of thousands of files were deleted from dozens of servers and around 2000 user machines. Affected applications included MS Office, and products from IBM (Rational), GreenHills, MS Office, Ansys, Adobe, Autocad, Hyperion, Win MPM, MS Shared, MapInfo, Macromedia, MySQL, CA, Cold Fusion, ATI, FTP Voyager, Visual Studio, PTC, ADS, FEMAP, STAT, Rational.Apparently the DAT file targeted mostly, if not exclusively, DLLs and EXE files." An anonymous reader added, "Already, the SANS Internet Storm Center received a number of notes from distressed sysadmins reporting thousands of deleted or quarantined files. McAfee in response released advice to restore the files. Users who configured McAfee to delete files are left with using backups (we all got good backups... or?) or System restore."
[+] Apple: McAfee Feigns Fear at Mac Security 403 comments
conq writes "BusinessWeek reports that McAfee has just come out with a report which asks the question 'Is Mac OS X the Next Windows?'." They appear to be attempting to scare consumers into buying anti-virus software for OSX. Blogger Arik Hesseldahl breaks down their claims: "First off, Mac users on average pay more for their computers, are self-selected because they tend to know more about technology than your average PC buyer, and by and large are a bit more affluent than those who buy cheapo commodity Windows PCs ... When you take into account the ongoing growth in general PC ownership, even if Apple pushes its annual unit sales to 12 million or more by 2010, its share of the overall market will still account for about 4%, leaving Windows the far more tasty target."
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • by Bin_jammin (684517) <Binjammin@gmail.com> on Thursday January 05 2006, @10:59AM (#14400622)
    disappointment. After they're gone, I'm sure it'll only be another twenty years before I stop seeing customers' boxen with Macafee's anti-virus expired demo notification popping up every time I touch it. Maybe they should have given away more nagware, that might have helped.
    • Re:Oh, what a... (Score:5, Insightful)

      by donnyspi (701349) <junk5&donnyspi,com> on Thursday January 05 2006, @11:15AM (#14400781) Homepage
      I see plenty of Norton demo expiration alerts appear on computers I fix. I think it's misleading and annoying to have virus protection expire after 90 days of use. I've seen plenty of people who see that Norton or McAfee is still on their system so they think they're protected. Of course, the responsibility of wise computer use should be that of the user, but let's face it, most users don't know much anyway and having their anti virus expire on them just confuses them more.
      • When Norton was getting ready to expire on my mother's computer, it gave her a pop-up message everyday saying that the subscription was going to expire and after that, she wouldn't be protected against new viruses, and gave a link to buy another year's subscription. I did this every day until I uninstalled Norton and installed AVGFree
        • Yea, I got that too. Made me homicidal. Another lovely was when it started losing its license number so it had to connect to Live Update every day or so and get the key reauthorized.

          I got completely fed up. Ripped that bitch outta my system, and am using AVG now. No complaints. I'll never use Norton or McAfee again.
    • Re:Oh, what a... (Score:5, Interesting)

      by scronline (829910) on Thursday January 05 2006, @11:48AM (#14401140) Homepage
      Well, that's funny. I don't see ANY nagware out of mcafee and that's part of the problem. I see it updating whenever it's an active subscription, but after that it just doesn't do anything. This is the online/newest version not the old stuff that did nag all the time. The problem I see with McAfee is everything is all online. While that's a good way to do it, customers sign up, then change ISPs, then change ...., and a year later they don't remember what information they used for online registration. The client doesn't even show their email address used so you have to take guesses at it. In several cases they have to buy a brand new AV client simply because they don't have access to the old email address.

      Furthermore, I've had cases where their antivirus would keep the anti-spam from working and thus mail would never get delivered. It would just sit there fighting each other. Let's not even talk about the thousands of machines that come into my shop that won't even boot because McAfee is damaged. Boot into safe, uninstall McAfee and the system will boot properly.

      I don't disagree that you would see McAfee for years after it's gone (by whatever method), but that's partly because of the poor way they keep the customer informed and handle the account/licensing. Their products are in desperate need of a complete revamping. I even get about 300 "spam from your network" emails because of their crap client a day. Not a single one of them come from my ISP, they just spoof an email address on domains run/hosted by us or spoof our domain in the EHLO statement.

      That's not to say Symantec is any better. Up until the 2006 version I was pleased with Norton, but now it's just so in your face that you have to wait 5 minutes after boot up before really doing anything because of a popup screen that says "Norton is up and working properly" kind of crap and will sit there for 30 seconds or until you physically close the window yourself. I've had quite a few times their stupid little popups gets right in my way, or even kicked me out of a game I was playing

      Mainstream AV is too intrusive (but I can understand why since users just keep ignoring what it's saying) and in several cases ineffectual. They are all bringing a false sense of security and allow users to think they don't still have to follow good security on their own like....I don't know....not opening email attachments they aren't expecting.

      On that note, I'll bet money on the fact that more than 70% of the computers that were infected with the most recent outbreak of the sober virus were all computers purchased with McAfee OEM with only 90 days of service and probably half of those weren't even activated the other half were unknowingly (or uncaring) expired. Gotta love it when OEMs use McAfee as the default OEM product by default.

      The thing to remember about nag screens, they are there for a reason. Users always "oh, I just clicked close on that" and then complain about "why do I get viruses", "why do people do that", "is there anything I can do to go after these people?", and my personal favorite "what can I do to keep this from happening again?".
      • Re:Oh, what a... (Score:4, Interesting)

        by SatanicPuppy (611928) <[moc.liamg] [ta] [yppupcinataS]> on Thursday January 05 2006, @12:02PM (#14401283) Journal
        I wasn't happy with Norton 2k4, but it was Norton 2k5 that really made me lose it. Resource hogging, constant badgering. I had the damn software running on a machine that was pretty well protected anyway, so the intrusiveness of it was infuriating.

        I've noticed when people have the fancy Norton Security Suites installed, they tend to disable them because it makes it too annoying to browse the internet, for example. You get psychotic firewall notifications every few seconds, and it doesn't really remember what applications are safe, so it bothers you over and over for the same damn program.

        It's that funny thing with security...The best security is so restrictive that people ignore it and disable it whereever possible...Like requiring 10 digit passwords, changed monthly...those damn things are always written on a sticky, stuck under the keyboard.
        • I can't disagree with that. Personally, just about every mainstream AV/Security company has irritated the ever-loving-crap out of me lately. But there is a difference between techs and tech savvy people vs. Joe the average user. I don't think it's so much that they want it easy, it's more that there's alot of laziness going on. I'm mean, I can't even tell you how many customers are calling us for net support and they just don't read the screen.

          notification: "Your Norton needs to update some of it's pro
      • "Mainstream AV is too intrusive..."

        And you KNOW why it ends up being that way ? Two reasons....

        1. The bloody OS is a more porous than a sponge for all sorts of junkware.

        2. Because they ( the Symantecs, and McAfee's of the world ) feel that they have to demonstrate blantantly to the user "Look how useful I am to you !! Look at me !!", so that they can try to justify in the user's minds the ridiculously overpriced license fees they charge for every nickel and dime piece of glopware they plaster your PC with.
    • Re:Oh, what a... (Score:5, Informative)

      by Slime-dogg (120473) on Thursday January 05 2006, @12:26PM (#14401512) Journal
      After reading up on the whole thing, McAfee did the funky accounting in the period from 1998 to 2000, and had $50m laying around, "reserved" for when they'd need it to pay the fine. I don't think that McAfee is really going anywhere any time soon.
  • wtf? (Score:5, Funny)

    by User 956 (568564) on Thursday January 05 2006, @11:01AM (#14400632) Homepage
    This is reminiscent of Enron's mark to market [investorwords.com] accounting, wherein you basically determine the real market asset value, then you just make up a bunch of shit.
  • Fines are not enough (Score:5, Interesting)

    by 110010001000 (697113) on Thursday January 05 2006, @11:01AM (#14400634) Homepage Journal
    Fines are not enough and hurt shareholders more than those who are responsible: the executives. The true punishment should be fines and jail time for the COO, CFO, CEO and all the other Cx0's. What does fining a company do except bleed the shareholders?
    • by Luscious868 (679143) on Thursday January 05 2006, @11:10AM (#14400733)
      Fines are not enough and hurt shareholders more than those who are responsible: the executives. The true punishment should be fines and jail time for the COO, CFO, CEO and all the other Cx0's. What does fining a company do except bleed the shareholders?

      Hey, wait just a second. Leave the poor CTO out of it :-)

    • The true punishment should be fines and jail time for the COO, CFO, CEO and all the other Cx0's

      I thought this what Sarbanes-Oxley was supposed to do. Anyone more knowledgeable than I know for sure?
      • by Reducer2001 (197985) on Thursday January 05 2006, @11:32AM (#14400960) Homepage
        As far as I can tell, SOX only causes pain and suffering to IT and accounting departments, and does not actually prevent executives from doing anything wrong. (IMHO as a low-level network flunky as part of a publicy-traded company)
    • "Fines are not enough and hurt shareholders more than those who are responsible: the executives."

      Who are the people that voted the executives into their jobs?

      The more shares a holder owns, the more responsible they are for putting these yahoos into these positions to begin with, and the more their bottom line should hurt. Don't like it? Don't invest; that will certainly clean things up in corporate board rooms.
      • by corbettw (214229) <corbettw AT yahoo DOT com> on Thursday January 05 2006, @11:30AM (#14400942) Homepage Journal
        Dude, the whole function of the corporation as we know it is designed as such to shield individuals from direct legal action. That's why they're so popular.

        Dude, you don't know what the hell you're talking about. Corporations shield their owners from bankruptcy and civil courts (to an extent). They do not shield the officers of those corporations from criminal charges. Just ask Enron Chief Accountant Richard Causey [cnn.com], who's serving seven years in jail for his role in the corporation's implosion. His old bosses, Ken Lay and Jeffrey Skilling, are about to get their day in court in the next few months, too. If they can find an impartial jury, that is (if they're smart, they'll try to plead out, but if they were smart they wouldn't have cooked the books in the first place...but that's another story).

        I don't know where this myth of corporations protecting people who out-and-out break laws came from, but it's not in the least bit grounded in reality. The cases where corporate executives get away with murder, figuratively and literrally, have more to do with state corruption than the legal fiction behind the "corporate veil". The infamous Union-Carbide tragedy was as much an exemplar of the corruption in certain parts of the Indian government as it was the amorality of company officials.
  • by IAAP (937607) on Thursday January 05 2006, @11:02AM (#14400646)
    accounting tricks.

    The method employed was 'channel stuffing' in which compliant re-sellers are effectively paid to buy and hold inventory they may never sell.

    I think there should be class in 'B' school called, "Accounting Tricks That Get You In Trouble with the Law: You're not as smart as you think you are."

    • There is a class called that. It's call Introduction to Auditing, which all accounting students take. What's bad is that the auditors for McAfee missed this.
        • by rmjohnso (891555) on Thursday January 05 2006, @11:53AM (#14401192)
          Actually, auditing is NOT fraud detection. The following wording is taken from a standard audit opinion letter:

          http://www.dsbcpas.com/services/accounting/audit/o pinionaudit.html [dsbcpas.com]

          Notice that fraud is NOT included in the opinion. The idea of fraud is to go undetected, and you cannot audit for collusion. Therefore, unless the environment suggests fraud is taking place, fraud is discovered by the company or auditor in the normal course of operations or the audit, or if the company reports to the auditor that fraud is taking place, it is extremely difficult to audit for fraud, if not impossible.

          The following link is to the auditing standards by the AICPA
          http://www.aicpa.org/members/div/auditstd/auditing _standards.htm [aicpa.org]
          See:
          SAS 1 - Responsibilities and Functions of the Independent Auditor
          SAS 99 - Consideration of Fraud in a Financial Statement Audit
  • Seems like a lot of companies are into hot potato. When did it become frowned upon to care about what happens to the business five or more years down the road?
  • And people wonder why they don't trust the government, the stock market, or anti-virus software to do what is right and correct. They need to run a thorough fraud scan on their accounting software and then quarantine the fraud.
  • by Ender Ryan (79406) on Thursday January 05 2006, @11:04AM (#14400665) Journal
    If they're corrupt enough to fuck their shareholders like that, I wonder what other lengths they're willing to sink to. Eg., I wonder if any of the anti-virus vendors actually create viruses themselves, so they can get one up on the competition by having the virus definitions already complete.

    I'm not making any accusations, of course, just food for thought. But, with all the corruption in corporate America these days, I'd actually be surprised if something like that hasn't taken place in at least one of the major firms.

    • I wonder if any of the anti-virus vendors actually create viruses themselves, so they can get one up on the competition by having the virus definitions already complete

      Not a new theory... IIRC back in the day AV companies would pay a "bounty" if someone came up with a new virus they (or their competition) hadn't seen yet. Thus making it tempting for some one to create a "virus" that may never actually get into the wild, but would score some bounty cash.

      Then company "M" could claim to scan for this new "BooB
    • And doctors go out and run people down in their cars so that they can then save lives and make a living... Health inspectors plant e.coli in the food they inspect... Firemen set fires randomly in the middle of the night so they have something to put out... Cops give gangs guns so they have gang violence to fight... Yeah... okay... and Microsoft purposefully pirates Windows for better market penetration...

      If you believe any of that... I'm very worried...
  • what interests me is what norton/symantec is going to do, now that (one of) their biggest competitors is in such a position.
  • It's always easier and often more profitable to take the money and run then build for the future.
  • Microsoft Rescue? (Score:4, Insightful)

    by bagboy (630125) <neo AT arctic DOT net> on Thursday January 05 2006, @11:06AM (#14400677)
    Seeing as how they (MSFT) are playing the anti-spyware role, maybe McAfee is ripe for a MSFT buyout and integration with Vista?
  • Hmmm... a company that cooks the books so they can lie to shareholders. What other unethical/illegal/standard business practices are they up to?
  • by Anonymous Coward on Thursday January 05 2006, @11:06AM (#14400679)
    No wonder corporate fraud is so popular. Even if you get caught, the cost is less than the benefit.

    This will continue until a lot of these people end up in prison for a few decades.
  • Never liked them anyways. 'Stuff was crap.
  • They probably figured they needed to do something. After all... a 800 lb gorilla (called Microsoft) just entered their space. So they are screwed anyways.
  • by kalpol (714519) on Thursday January 05 2006, @11:08AM (#14400714) Homepage
    Since Sarbanes-Oxley has only been in effect since last fiscal year, I wonder if this was caught during a SOX audit or it just got outed on its own.
  • WTF? (Score:5, Interesting)

    by Quixote (154172) * on Thursday January 05 2006, @11:08AM (#14400715) Homepage Journal
    When it caught up with them, McAfee's stock price crashed, wiping out a billion dollars of shareholder capitalization.

    If I cause damage worth X dollars, you can bet your ass that I will be forced to repay the amount. And yet these guys get away with paying a nickel per dollar? Shouldn't they be forced to compensate the shareholders for their losses? Take it out of the paychecks of all of the top executives! Throw some in jail! At the very least, take back the money these executives made due to the artificially high price.

    • Welcome to earth (Score:4, Interesting)

      by kahei (466208) on Thursday January 05 2006, @12:16PM (#14401406) Homepage

      Shouldn't they be forced to compensate the shareholders for their losses?

      No. No, they shouldn't. The shareholders bought the stock hoping it would go up. It went down. The shareholders factored in various kinds of risk -- market risk, credit risk, compliance risk. Looks like they should have allowed more for compliance risk in this case, but that's life.

      Are you suggesting that whenever a stock goes down because of human stupidity/greed/malice, investors who were holding it at the time should be compensated?

      What about when a stock goes up? Should investors with short positions, be compensated?

      Who should do the compensating? I don't think McAfee has that kind of money now.

      I think it might be a lot simpler and fairer to just expect investors to take responsibility for their own investments.

      I also think that it's pretty fucking sad that the above is no longer intuitively obvious to everyone.

      • ...is that the company lied to get shareholders to buy stock. The evaluation of risk was based on financial information (among others) provided by - and falsified by - the company. The executives should be held accountable for the losses sustained, as, probably, should the auditing firm. It's individuals who did the lying, not the corporation.

        Now, had the fall in stock price been for some exterior means. For example, all the virus writers in the world burst into flame and the viruses in the wild mysterious
  • by doit3d (936293) on Thursday January 05 2006, @11:08AM (#14400717)
    ....16,284 files scanned. Warning! Unknown file found: CookBooks.exe Do you wish to Quarantine or Delete?
  • Damn (Score:3, Funny)

    by c0dedude (587568) on Thursday January 05 2006, @11:09AM (#14400719)
    McAfee cooked its books, overstating its revenues one year by 131%, or half a billion dollars.
    Anyone else disappointed it wasn't for making shitty and processor hogging software?
  • by Andrewkov (140579) on Thursday January 05 2006, @11:10AM (#14400732)
    I hear this was caused by an Excel Marco virus, only McAfee was to embarrased to admit it.
  • Swan Song? (Score:4, Informative)

    by Bob(TM) (104510) on Thursday January 05 2006, @11:18AM (#14400812)
    Apparently, I missed the analyst gloom/doom forecast. I did see this:

    Analysts said the settlement would close a chapter in McAfee's history and let the company focus on its market, which is expected to heat up this year with the entry of Microsoft.

    Here's their finance info on Yahoo [yahoo.com]. They seem to have a $4.73B market cap and are currently dead center of their year stock price range.

    Doesn't seem that damaging to them, actually - though they are in for a tough scrap when MSFT gets in the act.
  • McAffee? (Score:3, Informative)

    by imipak (254310) on Thursday January 05 2006, @11:18AM (#14400814) Journal
    I think you mean Network Associates [nai.com], who bought McAffee years ago. Just after they'd bought Dr Solomon's, in turn, as it happens.
  • SENSATIONALISM (Score:5, Informative)

    by GodLived (517520) on Thursday January 05 2006, @11:59AM (#14401256) Journal
    This story is being spun into sensationalistic crap. The story is, the fine is being levied by the SEC for, and I qtfa, "securities fraud ... during the period between 1998 and 2000." I used to work for McAfee, and I want to educate the community.

    All of what you know as McAfee used to be called Network Associates up until about 2004. It was formed in 1998 by a massive buy-up of various software firms, including Network General and McAfee Associates - hence the name, "Network Associates." During this reign, the CEO committed the fraudulent acts, including the channel stuffing as indicated, and was eventually fired in 2000 or 2001 for fraud. The new CEO, George Samenuk, took over and has since been credited with turning the company around, reestablishing the McAfee brand identity, focussing on the core products, cutting loose various deadwood (including, unfortunately, the research group that I worked for), and returning the company to legitimate profitability. At an all-hands (the one time Samenuk braved a visit to us research dweebs), he explained that the old regime consisted of "crooks," and that he vowed to be forthright with the SEC and do his personal best to fly straight. To my knowledge, he has done a good job of that ever since.

    This fine being reported today is a result of the SEC, acting in good government swiftness, merely enforcing a punishment for deeds done in the past, under different leadership. Take this news as no indication of the current state of the company or its leadership, but view it merely as a capstone to an unfortunate period in McAfee's history.
  • by kalbzayn (927509) on Thursday January 05 2006, @12:08PM (#14401334) Homepage
    Now I understand why their software used to tell my computer it had two viruses but could never do anything about them. The software was following the coorporate policy of overstating results.
  • Just converted... (Score:3, Interesting)

    by BoldAndBusted (679561) on Thursday January 05 2006, @12:43PM (#14401691) Homepage
    ...the single Windows machine in the house (my girlfriend's) to Trend Micro's PC-cillin a few nights ago. The box had been using McAfee for over a year, and I really didn't like how it seemed to refuse to auto-update, and manual update's often buggy use of Active X controls (i.e. IE). I really liked their Scanmail for Exchange product, and I'm glad to use it for client use now, as they appear to have worked out some kinks that were present in earlier versions.

    Yes, I can tell that PC-cillin also appears to use Active X for manual updates (would love to be corrected), but, in my case, the auto update works well, so there is no need to use the manual update. And I personally believe that the Trend Micro labs are quicker on the draw on new viruses and trojans, which, in the end, is what I pay for.
  • by MrBandersnatch (544818) on Thursday January 05 2006, @02:13PM (#14402655)
    "I cant trust something from a company called Make-A-Fee".