US Air Force pilots used malware-laden USB drives to plan Afghanistan missions

Welcome, once again, to PWNED, the weekly column where we gawk at organizations that have made serious security mistakes.

Normally, we’re talking about businesses or maybe the odd school that messes up, but today we’re writing about a serious IT screwup in the world’s most powerful military.

Have a story about someone leaving a gaping hole in their network? Share it with us at [email protected].

Anonymity is available upon request.

Today’s tale comes from Justin Henkel, the CISO of IT monitoring and service company SolarWinds.

Henkel previously worked in IT security for the Air Force and one day in the early 2000s saw a practice that just wouldn’t fly today.

Before USB drives became popular, burning CDs with mission data was the modus operandi, and those discs were put in both unclassified and classified systems.

“They would write a CD, and then they would take that CD and then put it in a classified system and do the remainder of the mission planning,” Henkel told us.

“Then they would take that disc and then put it in the airplane.” Inside the airplane, the data on the CD would help the pilot navigate and contain information about threats they might encounter.

Later, when thumb drives became a thing, pilots used them instead of discs.

“They didn't really think about the overall impact of classified versus unclassified systems,” Henkel said of the pilots.

“Using the same device for both, they didn’t understand that you could read and write onto a USB drive with malware. [They were] not really understanding the overall threat picture.” According to Henkel, Air Force personnel would buy their flash drives from local vendors rather than sourcing them from official military contractors.

If they were in Afghanistan, those drives could literally come from a store in Kabul.

And it wasn’t exactly the equivalent of Best Buy.