Welcome, once again, to PWNED, the weekly column where we gawk at organizations that have made serious security mistakes. Normally, we’re talking about businesses or maybe the odd school that messes up, but today we’re writing about a serious IT screwup in the world’s most powerful military.
Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request.
Today’s tale comes from Justin Henkel, the CISO of IT monitoring and service company SolarWinds. Henkel previously worked in IT security for the Air Force and one day in the early 2000s saw a practice that just wouldn’t fly today.
Before USB drives became popular, burning CDs with mission data was the modus operandi, and those discs were put in both unclassified and classified systems.
“They would write a CD, and then they would take that CD and then put it in a classified system and do the remainder of the mission planning,” Henkel told us. “Then they would take that disc and then put it in the airplane.”
Inside the airplane, the data on the CD would help the pilot navigate and contain information about threats they might encounter.
Later, when thumb drives became a thing, pilots used them instead of discs.
“They didn't really think about the overall impact of classified versus unclassified systems,” Henkel said of the pilots. “Using the same device for both, they didn’t understand that you could read and write onto a USB drive with malware. [They were] not really understanding the overall threat picture.”
According to Henkel, Air Force personnel would buy their flash drives from local vendors rather than sourcing them from official military contractors. If they were in Afghanistan, those drives could literally come from a store in Kabul. And it wasn’t exactly the equivalent of Best Buy.
“It was more difficult to bring a US-based computer into the nation than it was just to buy local,” he said. “So they were just going out into the local market in Kabul or whatever city that they were out [in]. And I used to do this: go out, make relationships with the local vendors. ‘Hey I need 100 USB sticks.’”
Unfortunately, enemies of the US noticed and soon started selling infected USB drives to local vendors in the Middle East.
Henkel knew that using a sneakernet with classified systems was a recipe for disaster. It’s just that no one would listen to him.
“It was just a shock,” he told us. “I was a young 22-year-old guy, very junior in the overall rank system, trying to tell colonels and majors that what they’re doing is a violation.”
In 2008, the US Department of Defense was infected by malware after somebody attached an infected USB flash drive to a laptop with access to US Central Command. The worm, dubbed Agent.BTZ, could collect information from infected computers and communicate with remote servers. A 2016 report from the FBI and DHS attributed the malware to one or more Russian groups.
It took the Pentagon 14 months to scrub it from its systems.
It took this attack for the Pentagon to wise up in 2008 and ban the use of USB drives, instead forcing data transfers to go through more secure systems. Eventually, in 2010, the drives were allowed again under certain circumstances. ®