Unsecured USB Drives Compromised U.S. Central Command

Former U.S. Air Force security personnel recently revealed that pilots used unverified USB drives to move mission data between systems in 2008.

The Register reported that pilots bought flash drives from local vendors in Kabul and other Afghan cities. Pilots used the USB sticks on both unclassified and classified systems.

In time, flash drives loaded with malware found their way onto U.S. bases in the Middle East. Ultimately, malware infected a network run by the U.S. Central Command (CENTCOM).

This reckless usage highlights the dangers of unsecured USB flash drives. However, the convenience of removable media doesn’t have to pose a massive security risk.       

How Malware Spreads Using USB Flash Drives 

Malware typically exploits autoplay features to infect systems from a thumb drive. The policies allow an external device to connect and automatically run programs.

The Register describes a workflow in which Air Force pilots plugged USB sticks into an unclassified system. They frequently began mission planning and saved data from these computers to the flash drives. They often finished their planning on classified systems later. When they resumed, pilots connected the same USB flash drives to more trusted systems.

Eventually, a USB drive with the Agent.BTZ worm was inserted into a laptop with access to CENTCOM servers. The worm spread and infected the CENTCOM network undetected. From there, the malware strain exfiltrated data to servers under foreign control.

In late 2008, the Department of Defense (DoD) detected the infection and launched Operation Buckshot Yankee to counter the malware.

The 14-month effort ended with the removal of malware from classified servers, but the damage was already done.

In response, the DoD banned flash drives and mandated more secure channels for file transfers. In 2010, the DoD permitted USB drives again, but strictly monitored their use.

So, what does secure USB flash drive use look like?

SecureUSB®: Encrypted Flash Drives for Sensitive File Transfers

SecureData developed encrypted flash drives for individuals and organizations that handle sensitive data.

Our products are designed with data protection in mind. The SecureUSB® BT and SecureUSB® KP achieved FIPS 140-2 Level 3 validation from NIST. They feature robust AES encryption, auto-wipe measures against brute-force attacks, and tamper-resistant components for lost or stolen thumb drives.

You can also use SecureUSB® with our Remote Management Console to enforce security standards, such as geofencing and time-based access policies.

In short, they are ideal USB flash drives for regulatory compliance.

Additional features make them even more well-suited for parties that want convenience without risking malware.

DriveSecurity® Provides Automatic Scanning and Virus Removal

Our SecureUSB® products work with DriveSecurity® to stop malware before it can infect systems and spread throughout networks. 

DriveSecurity® is a powerful USB antivirus utility. The tool resides on the drive itself, so it requires no host installation. It automatically scans for worms, viruses, rootkits, and spyware during file transfers involving the flash drive. 

If the tool detects malware, it will flag the file as infected. The utility immediately purges the infection from the drive. The infected file never reaches the system, shared computers, or other networks.

DriveSecurity® also detects existing malware on a USB stick. Once installed, it scans and notifies the user of any infection.

Using a flash drive with a USB antivirus tool is an effective way to address the threat of malware on external storage.

USBtoCloud® Enables Secure Cloud Backup

Spreading malware is one of the biggest dangers of an infection. If left undetected, malware can compromise files outside the computer.

USBtoCloud® uses DriveSecurity® to ensure that an infection isn’t uploaded to Google Drive, OneDrive, Dropbox, or AWS.

This smart design contains the damage of an infection without sacrificing the convenience of cloud storage and file sharing platforms.

Use SecureUSB® To Protect Portable Storage

Since 2007, SecureData has offered data protection solutions for professionals who demand higher security. Our encrypted drives have helped large corporations, financial and legal firms, healthcare institutions, government agencies, and the military secure their data.

Using a USB drive to streamline workflows in a modern environment doesn’t have to compromise your security.

Contact us to request a free evaluation for our SecureUSB® BT, SecureUSB® KP, or SecureUSB® DUO encrypted flash drives.