Pentagon banning flash drives...

"The Pentagon has banned, at least temporarily, the use of external computer flash drives because of a virus threat officials detected on Defense Department networks.

While defense officials would not publicly confirm the ban, messages were sent to department employees informing them of the new restrictions. As part of the ban, the Pentagon was collecting any of the small flash drives that were purchased or provided by the department to workers, according to one message distributed to employees.

Workers are being told there is no guarantee they will ever get the devices back and it is not clear how long the ban will last.

Pentagon spokesman Bryan Whitman would provide no details on the virus Friday, but he described it as a "global virus" that has been the subject of public alerts."

http://tech.yahoo.com/news/ap/200811...n_cyber_threat

Yeah, I've been tracking that particular "virus" for some time now.

Quote:

---

he described it as a "global virus" that has been the subject of public alerts.

---

It is called the "turd for brains military and public servants virus" Expect laptops and R/W optical media to be added to the list in the near future :D

Anything that goes off an even remotely secure site must be encrypted and on read only media........... but they still manage to lose stuff and bring in malware................ I wonder how and why?

:rolleyes:

I didn't think they allowed it in the first place.

Quote:

---

Originally Posted by nihil

...the "turd for brains military and public servants virus"

---

That was around long before computers were. Goes in
the blind-leading-the-leading-the-blind category.

Quote:

---

Originally Posted by nihil

... but they still manage to lose stuff and bring in malware................ I wonder how and why.

---

Some things were never meant to be understood.

Would someone mind posting the article for me to read here as it is blocked here at work.

Thanks.

WASHINGTON - The Pentagon has banned, at least temporarily, the use of external computer flash drives because of a virus threat officials detected on Defense Department networks.

While defense officials would not publicly confirm the ban, messages were sent to department employees informing them of the new restrictions. As part of the ban, the Pentagon was collecting any of the small flash drives that were purchased or provided by the department to workers, according to one message distributed to employees.

Workers are being told there is no guarantee they will ever get the devices back and it is not clear how long the ban will last.

Pentagon spokesman Bryan Whitman would provide no details on the virus Friday, but he described it as a "global virus" that has been the subject of public alerts.

"This is not solely a department problem, this is not solely a government problem," Whitman said.

The Pentagon has acknowledged that its vast computer network is scanned or probed by outsiders millions of times each day. Last year a cyber attack forced the Defense Department to take up to 1,500 computers off line.

Officials said then that a penetration of the system was detected, but the attack had no adverse impact on department operations.

However, military leaders have consistently warned of potential threats from a variety of sources including other countries — such as China — along with other self-styled cyber-vigilantes and terrorists.

The issue has also been of concern at the Department of Homeland Security. A September audit by the DHS Inspector General recommended that the agency implement greater procedures to ensure that only authorized computer flash drives or other storage devices can be connected to the network there and that an inventory of those devices be set up.

DHS agreed with the recommendations and said some of that is already being done. DHS also said more software enhancements are in the works that will provide more protection.

Flash drives/other removable media have nothing to do with their current problem. As Nihil put it so eloquently (sp.?), stupidity seems to be the major issue. Another issue is a lack of adherence to policies (if they even have any) regarding basic system protection (weak/blank passwords, etc)...

Hi, NukEvil................. I fixed the spelling for you mate:)...... nihil

Quote:

---

Originally Posted by The-Spec

I didn't think they allowed it in the first place.

---

Exactly!

@ phernandez and The-Spec,

Correct me if I am wrong, but I seem to recall that there was a scandal about flash drives when we first went into Iraq?

Apparently local support staff at US bases were stealing them because they were just left plugged in or lying around?

:(

Quote:

---

Originally Posted by The-Spec

I didn't think they allowed it in the first place.

---

Not true. USB drives have been widely used, as reflected in NASA's somewhat convoluted policy.

http://www.nasawatch.com/archives/20...umb_drive.html

Thank God for camera phones for those 1-page screenshots on a SIPRNet and NIPRNet connected secured card accessed workstation. Thank Jesus for LinuxBoot cd's with usb turned on to read NTFS Documents and Settings. Thank God for bored and lazy sheep in the military who care less. Thank Microsoft for reintroducing virii and bugs that were addressed in older distrubitions but forgotten in newer versions so security experts can pay their rent for the month

As NukEvil says:

Quote:

---

Flash drives/other removable media have nothing to do with their current problem.Stupidity seems to be the major issue. Another issue is a lack of adherence to policies (if they even have any) regarding basic system protection (weak/blank passwords, etc)...

---

This is a much more fundamental and deep seated problem that has nothing to do with technology or operating systems. In fact, to suggest that it has is to make an even greater mistake of suggesting that technology can provide the solution. Which, of itself, it cannot.

This is about:

1. A security model.
2. Security policies.
3. Security processes to enforce the policies.
4. Security procedures to support the processes.
5. Governance & management of the security system.

Given that there is generally a high turnover of personel in military and government environments it is vital that there is an appropriate succession and training mechanism to prevent the whole system being gradually degraded.

Quote:

---

This is about:

1. A...model.
2. ...policies.
3. ...processes to enforce...policies.
4. ...procedures to support...processes.
5. Governance & management of...???

---

The tech is changing every week or every month. Code is inherently
insecure. Human beings are...sinners. Hardware's spread from here
to kingdom come and tied to some database, now tied to some other
database. And the newest 'model' is...a cloud?

Noam Eppel is right...security is absurd. CYA. No one else will.

Quote:

---

Originally Posted by nihil

@ phernandez and The-Spec,

Correct me if I am wrong, but I seem to recall that there was a scandal about flash drives when we first went into Iraq?

---

You mean when soldiers film the battlefield operations meant to stay secret only to have the young soldier remove the 8GB micro-sd card. I bet 99% of them don't know what a stamp flash drive look like. You could easily walk past Gomer Pile.

http://counterterrorismblog.org/

Who is watching the watchers? funny stuff

Quote:

---

You mean when soldiers film the battlefield operations meant to stay secret only to have the young soldier remove the 8GB micro-sd card.

---

No, this was just kit around offices etc where they employed locals as janitors and support staff. They just stole it because it was easy pickings?

Linen0ise

Roaches have eaten your Avatar man!!!!!! :shocked:

Time for you to use your "RAID" knowledge huh? :lildevil:

LOL that was a good one

Flash drives are allowed on certain networks, banned on others. The Federal government does not have a global policy on this, although there are numerous "recommendations."

My network bans flash drives and most writeable media. I almost thought that they were concerned about security, until I discovered that Cisco's Port Security is actually considered to be a security measure, and not just a way to piss off users and techs.

It should have been done alot sooner.

While they are very convenient, they pose a tremendous risk to both the OPSEC and CIA of a network.

The previous incidents in both Iraq and Afghanistan should have outlined to DoD the tremendous risk that they posed to both OPSEC and CIA.

At the time of those incidents, their main concern was an OPSEC one - controlling the spillage of classified matterial and PHI that were leaked to outside sources. They were too nearsighted to see the other risks to CIA.

In the years since those incidents, there have been numerous exploits and proof of concept attacks demonstrated at both BlackHat and DEFCON concerning these devices.

The blame rests with the agency CIO's and DAA's who did not formulate effective countermeasures when conducting their risk analysis.

It also rests with the IA managers, department managers, and commanders at every level for not ensuring that the end-users had the proper training needed to mitigate the risk.

Unfortunately, there is no patch for human stupidity.

Quote:

---

Originally Posted by 576869746568617

It should have been done alot sooner.

While they are very convient, they pose a tremendous risk to both the OPSEC and CIA of a network.

The previous incidents in both Iraq and Afghanistan should have outlined to DoD the tremendous risk that they posed to both OPSEC and CIA.

At the time of those incidents, their main concern was an OPSEC one - controlling the spillage of classified matterial and PHI that were leaked to outside sources. They were too nearsighted to see the other risks to CIA.

In the years since those incidents, there have been numerous exploits and proof of concept attacks demonstrated at both BlackHat and DEFCON concerning these devices.

The blame rests with the agency CIO's and DAA's who did not formulate effective countermeasures when conducting their risk analysis.

It also rests with the IA managers, department managers, and commanders at every level for not ensuring that the end-users had the proper training needed to mitigate the risk.

Unfortunately, there is no patch for human stupidity.

---

Without pointing at any specific individuals, I have met numerous Information Security Officers, both within the Federal sector, and many private sector corporations. None have really impressed me. Most seem to lack any technical aptitude at all.

Unfortunately, that seems to be a very common occurance. It's both funny and disturbing how most commands treat duty positions like the IASO/ISSO.

Most that I have seen view it as an inconvience...just another appointment memo that has to be filled out for inspection purposes. They just arbitrarily put a name on a memo, and that's it. They don't even think about the individual's qualification to actually perform the job.

Hopefully, with the latest revision of DoD Directive 8570.1, some of this will change. Finally, they are requiring that all personnel in any IA related position complete not just DoD and component specific training, but also obtain an industry standard certification such as CompTIA's Security+ or ISC2's CISSP.

Not only do they have to get certified, but they are also now required to maintain the certification through continuing education and re-certification if needed.

While this is not a cure-all, it is definately a step in the right direction.

Well, from what I have seen over here it isn't that there aren't policies with the processes and procedures to support them.

It is more that the rank and file are not properly educated in applying them, or even understand why they are there?

A chain is only as strong as its weakest link ;)

I do recall getting a filing cabinet........... seemed a bit "heavy" when it was delivered to my office.............. what I found in it was disturbing.......... even though well within my security clearance. And that was all paper documentation........... no computer systems involved.

Just wanted to update this thread with a story the pentagon wants to forget. Military will never win this battle if their soldiers are not held responsible for their actions. Department of Defense is freaking out over it.

http://tinyurl.com/c3xwtc

Hmmm, an MP3 player eh?

Strange, but I read an article a few days ago about people using them for software piracy. I suppose they are really just a fancy thumb drive at the end of the day.

I can see the motive as the article would seem to suggest that the device was purchased around 2004. High capacity thumb drives were still quite expensive back then. Having said that, someone still broke the rules by bringing unauthorised equipment on site and connecting it to the system.

The trouble with this sort of technology is that it is small (and easily lost) and it is all too commonplace and familiar these days. As the saying goes: "familiarity breeds contempt", and people are just too blase.

I think that there is a bit of a psychological slant as well. Back in the day, we had removable HDDs in caddies and the computers had drive bays to accommodate them (I actually found a couple of them in my workshop the other day:D). When you were not using it you removed it and locked it away in a MoD approved secure cabinet.

This had a twofold effect:

1. Without the drive the computer won't work and its absence from the network would soon be noticed and investigated.

2. If you saw one you knew it contained secret material instinctively. After all you were used to locking them away.

And they would never be sold by accident as the procedure was to wipe them and physically destroy them.

Anyone in the know would immediately recognise one (assuming the caddy was still there) at a yard sale, second hand shop or whatever. They would buy it, and then the excrement would certainly hit the Venturi propeller. :lildevil:

My point is that there was this subconscious respect for them that thumb drives just don't generate.

Quote:

---

Originally Posted by Linen0ise

Just wanted to update this thread with a story the pentagon wants to forget. Military will never win this battle if their soldiers are not held responsible for their actions. Department of Defense is freaking out over it.

http://tinyurl.com/c3xwtc

---

The guy reportedly returned it along with the "only" copy of the data he made.

http://www.google.com/hostednews/ap/...54bYAD960GL281

Rofl, phernandez good find. For 1 if you admit you copied it, is anyone going to believe you when you say you only made ONE! And it probably would be smart if he does have another copy of that info not to post it now that they know who had it :-P

The problem here seems to be one of an embarrassing exposure of lax security procedures?

The actual data are pretty much irrelevant after 3 years if you take into account the length of a tour of duty ;)

Chris should social engineer the airport by buying a ticket. That ticket will have a special code only the screeners could recognize. If he gets special screening treatment then you know the government does not trust him. He's on the terrorist watch lists. ;)

His story sorta does not make since. Original articles stated he bought it for $9 not $18. It took him a year to notice those files? I am sure this person downloaded the instruction manual off the internet. If the government is smart, they would look at the metadata of those word\excel documents to monitor creation and last accessed dates. Hopefully they gave him pure LSD and hooked him up to a lie detector. If a real spy had access to those documents, they would cross index the authors of those documents with the names and address obtained for off-base access. 2005 or not, those people have to the clearance to be current and in-the-know. Breached.

To add: the guy told reporters about the incident. Even had a journalist from her office prank call a soldier but yet he always had the device on his person. She was dumb enough to post some still pictures of the documents. She had to know that government was coming after it. So yeah, there are more copies. Stupid government.

LO,

Quote:

---

If he gets special screening treatment then you know the government does not trust him. He's on the terrorist watch lists.

---

Last time I went to Ireland from the UK they asked me to take my shoes off.................. they won't make that mistake again :lildevil: (just check my avatar and the flies around Bill the Cat):D

Quote:

---

Original articles stated he bought it for $9 not $18.

---

I am guessing that might have something to do with the time difference between reports and the probability that we are talking USD (US Dollars) in one instance and NZD (New Zealand Dollars) in the other. I am not sure but I would have thought that a $1 (USD) = $2 (NZD) exchange rate has been possible over that timeframe?

OK those are just questions to take into consideration.

EDIT:

1.00 US dollars = 1.96 New Zealand dollars
Exchange rate: 1.963400 Rate valid as of: 2/2/2009