Posted on 10/15/2011 9:36:58 AM PDT by jmaroneps37
For the last two weeks Air Force computer specialists have been battling a computer infection of ground based computers that control drones operating over the Mideast. The administration specialists at Creech AFB, Nevada wanted to keep the incident quiet till they could eliminate the virus by themselves.
Instead of asking for help the command was overwhelmed by a virus that couldn’t be easily removed. Because of the time wasted it may take a while before the extent of the infection is known and what systems have been compromised.
Keylogger
The virus affecting the ground stations was a “keylogger” virus. A keylogger is an almost unnoticeable spyware that monitors key strokes and control clicks and sent the information to an external host computer. This virus had been found on several unclassified and classified computers. As of this time investigating officials haven’t determined how the virus was introduced into the network. Because of the time wasted in trying to remove the infection the so-called smoking gun will be difficult to discover.
The keylogger virus on the Creech computers are most likely Kernel-based or rootkit based virus which are most sophisticated and the most difficult to remove. The virus was most likely delivered by a Trojan that is behaving as a benign file.
To date it is not known if the virus has damaged any systems or transmitted recorded keystroked to an external host. Such an attack should of have been reported to the 24th Air Force, Cyber Command, but it wasn’t. The Air Force needs to know that one of its vital systems has been compromised.
How did Cyber Security know?
The Air Force’s cyber security specialists were surprised ……. learned about the virus infection in the pages Wired.com.
The Air Force’s cyber command had to admit……
(Excerpt) Read more at coachisright.com ...
Looks like the virus got onto the system through USB drives. Its attempts to notify an external system will be in vain, however it is a lousy security design to assume that no external media will ever be introduced to the system. That’s how viruses worked in the early days, although through diskettes rather than our modern USB drives.
Period.
I haven't heard about this. More info please.
Computer systems that should NEVER, EVER, be Microsoft Windows bases:
DoD
Homeland Security
Department of Energy
National Power Grid
Computer systems that should NEVER, EVER, be Microsoft Windows bases:
DoD
Homeland Security
Department of Energy
National Power Grid
...or anything else!
Cheers!
The command in question had been treating the symptom (removing the virus) without finding the cause (a specific infected drive used to bring data from another base.)
So we gave in to Bradley Manning’s agenda, but we learned nothing from his crimes. Great job, bureaucrats.
This what I was referring to Sorry my mistake.
Disneyland provides the model for the military in this - each command system has physically taped to the computer a set of restoration discs to return the system to certified state in case of malfunction or infection. If there is a concern, the system is restored from those discs, and if there is a hardware failure, those discs can restore the image to another computer for immediate repairs.
The certification of classified machines is the problem here. A computer restored from backups must be re-certified before it can hold classified information again. Whereas an image of that machine at time of certification, as well as restoration of secure documents from the server, means that downtime in the event of an intrusion such as a virus can be mere hours rather than weeks.
And it would take very little to secure these machines against USB intrusions. A change in government procurement to require machines certified for government service to include a small cut out in the USB connectors so that a physical lock can be installed on all USB connections that are unused, and a further requisition for keyboards and mice that physically lock into place would nail down a lot of these problems. File transfers to USB dongles could be accomplished through a read only host server and prevent these USB devices from ever mounting as system discs.
Any time a system puts barriers in to prevent local and swift correction of problems, they open the door for a breakdown in the secure system itself. A buck's worth of backup DVDs could have restored these systems, and cheap locks on usb ports could have prevented the intrusion in the first place.
Weld up the USB ports, cut off the antennas and make the network closed.
Swappable HDs would make the restore only a matter of a few minutes.
DOD has been hit numerous times during this war due to the activities of its users. This is a an example of a user using a storage device for classified and unclassified data, a huge no no.
One solution would be mobile storage that will only work between client computers and won't connect on those without client software. Another would be a drive that logs the MAC addresses it is plugged into, but that would require auditing.
When? Do you have details?
A Marine and a Navy medic killed by a U.S. drone airstrike were targeted when Marine commanders in Afghanistan mistook them for Taliban fighters, even though analysts watching the Predator's video feed were uncertain whether the men were part of an enemy force.
You're a damned liar.
I'll bet it came in via sneaker-net.
I don’t get how a classified computer can be connected to the outside world. It wasn’t allowed when I was working in a SCIF in the Air Force (1993-95 timeframe).
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.