Historic US Air Force practice of using locally bought USB drives across classified systems exposed military to Agent.BTZ-style malware
In a PWNED column, SolarWinds CISO Justin Henkel, a former US Air Force IT security specialist, recounts that in the early 2000s pilots and mission planners moved mission data between unclassified and classified systems using CDs and later USB thumb drives. Personnel often bought the drives from local vendors, for example in Kabul, rather than from approved military suppliers. Henkel says adversaries noticed and began selling infected USB drives to local vendors in the Middle East. His warnings about the practice as a junior airman were ignored by senior officers. The article links this lax practice to the 2008 Agent.BTZ infection of US Department of Defense networks, including a laptop with access to US Central Command. This is a retrospective anecdote, not a new incident.
Detalhes técnicos
- Mission data was shared via removable media (CDs, then USB drives) between unclassified and classified systems, a sneakernet that bypassed network separation.
- Drives were bought from local markets, for example in Kabul. Per Henkel, adversaries sold pre-infected drives to local vendors.
- In 2008, Agent.BTZ spread after an infected USB flash drive was attached to a laptop with US Central Command access. The worm collected information from infected hosts and communicated with remote servers.
- A 2016 FBI/DHS report attributed the malware to one or more Russian groups. No specific actor is named in the article.
- The Pentagon needed 14 months to remove the malware from its systems.
Remediação
- The Pentagon banned USB drives in 2008 and forced data transfers through more secure systems. In 2010 the drives were allowed again under certain circumstances.
- Source drives only from vetted suppliers, and do not reuse the same removable media across classified and unclassified systems.
Linha do tempo
-
Historic US Air Force practice of using locally bought USB drives across classified systems exposed military to Agent.BTZ-style malware
ler a análise desta fonte ocultar
In a PWNED column, SolarWinds CISO Justin Henkel, a former US Air Force IT security specialist, recounts that in the early 2000s pilots and mission planners moved mission data between unclassified and classified systems using CDs and later USB thumb drives. Personnel often bought the drives from local vendors, for example in Kabul, rather than from approved military suppliers. Henkel says adversaries noticed and began selling infected USB drives to local vendors in the Middle East. His warnings about the practice as a junior airman were ignored by senior officers. The article links this lax practice to the 2008 Agent.BTZ infection of US Department of Defense networks, including a laptop with access to US Central Command. This is a retrospective anecdote, not a new incident.
Technical Details
- Mission data was shared via removable media (CDs, then USB drives) between unclassified and classified systems, a sneakernet that bypassed network separation.
- Drives were bought from local markets, for example in Kabul. Per Henkel, adversaries sold pre-infected drives to local vendors.
- In 2008, Agent.BTZ spread after an infected USB flash drive was attached to a laptop with US Central Command access. The worm collected information from infected hosts and communicated with remote servers.
- A 2016 FBI/DHS report attributed the malware to one or more Russian groups. No specific actor is named in the article.
- The Pentagon needed 14 months to remove the malware from its systems.
Remediation
- The Pentagon banned USB drives in 2008 and forced data transfers through more secure systems. In 2010 the drives were allowed again under certain circumstances.
- Source drives only from vetted suppliers, and do not reuse the same removable media across classified and unclassified systems.