How US Air Force Pilots Flew Missions With Malware-Infected USB Sticks From Kabul Bazaars
Most IT security horror stories involve a poorly configured S3 bucket or a company that skipped two-factor authentication. This one involves the United States Air Force buying USB drives from street vendors in Afghanistan and plugging them into classified military systems.
The story comes from Justin Henkel, now CISO at SolarWinds, who spent time working in Air Force IT security in the early 2000s. What he witnessed was the kind of operational security failure that keeps infosec professionals awake at night.
Before thumb drives were commonplace, pilots burned mission data onto CDs. Those discs moved freely between unclassified systems, classified systems, and eventually into the cockpit itself, where the data helped with navigation and threat awareness. When USB drives arrived, pilots simply swapped one portable medium for another and carried on with the same habits.
The problem was that nobody stopped to think about what plugging the same device into both classified and unclassified systems actually meant. "They didn't understand that you could read and write onto a USB drive with malware," Henkel said. Fair enough if you're a pilot. Less fair if you're the person responsible for protecting military networks.
It gets worse. Rather than sourcing drives through official military supply channels, Air Force personnel stationed in places like Afghanistan were buying them from local markets. Actual shops in Kabul. Henkel explained that it was often easier to walk out and buy local hardware than to import US equipment into the country. So that's what they did.
"I used to do this myself," he said, describing building relationships with local vendors and ordering batches of a hundred drives at a time.
Predictably, adversaries worked out what was happening and started seeding the local supply chain with infected drives. It was a remarkably low-tech attack vector against one of the most sophisticated militaries on the planet.
Henkel saw the problem clearly and tried to raise the alarm. He was 22 at the time, junior in rank, and found himself attempting to explain to colonels and majors that what they were doing was a serious security violation. Nobody wanted to hear it.
The consequences eventually made themselves impossible to ignore. In 2008, an infected USB drive was connected to a laptop on a network linked to US Central Command. The malware, known as Agent.BTZ, spread across military systems, harvesting data and phoning home to remote servers. The FBI and DHS later attributed it to Russian state-linked actors.
It took the Pentagon fourteen months to fully remove it.
Fourteen months. From a USB stick someone bought at a market.