US Air Force pilots used malware infected USB drives to plan Afghanistan missions

Flash drives bridged classified and unclassified networks

US Air Force pilots planning missions in Afghanistan routinely used the same removable media on both classified and unclassified systems, a practice that left military networks exposed to malware. Before USB flash drives became widespread, personnel burned CDs with mission data and moved them between systems, then loaded the discs onto aircraft, where the data helped pilots navigate and provided information about possible threats.

Flash drives bought in Kabul markets

Justin Henkel, now CISO at IT monitoring company SolarWinds, said the drives were not sourced from official military contractors. Air Force personnel bought them from local vendors instead, in some cases simply picking them up from stores in Kabul. Henkel described going out into local markets and building relationships with vendors to buy large quantities of USB sticks.

Henkel worked in Air Force IT security in the early 2000s and tried to raise concerns as a 22-year-old junior service member, telling colonels and majors that using the same device across classified and unclassified systems was a violation. His warnings were not heeded.

Infected drives reached military systems

Hostile actors noticed the procurement pattern and began selling infected USB drives to local vendors in the Middle East. According to Henkel, the pilots did not understand that a USB drive could be read and written with malware, and the overall threat picture was not appreciated.

Agent.BTZ forced a Pentagon ban

In 2008, a USB flash drive infected with the Agent.BTZ worm was attached to a laptop with access to US Central Command, compromising the Department of Defense. The worm could collect information from infected computers and communicate with remote servers. A 2016 FBI and DHS report attributed the malware to one or more Russian groups, and the Pentagon needed 14 months to scrub it from its systems.

The attack prompted the Pentagon to ban USB drives in 2008 and force data transfers through more secure systems. Flash media was permitted again in 2010 under certain circumstances.

Sources: The Register