Defense Department Computers Attacked Via Flash Drive

The computer network belonging to the U.S. military's Central Command was successfully infiltrated in 2008 via Flash drives, according to The Washington Post.

Deputy Defense Secretary William J. Lynn III described the attack in an article that was published this week in Foreign Affairs magazine.

The incident occurred in 2008 at a post in the Middle East and was performed via a USB Flash drive, which installed malware. "That code spread undetected on both classified and unclassified systems, establishing what amounted to a digital beachhead, from which data could be transferred to servers under foreign control," Lynn said.

The Los Angeles Times reported in 2008 that the incursion might have originated in Russia, citing anonymous Defense officials.

"Operation Buckshot Yankee," which countered the attack, was a turning point for military computer security. Part of the response was a temporary ban on the use of Flash drives in military computers. That ban has since been modified. The broad outlines of the attack have been reported over time, but the details had heretofore been kept secret.

The Post suggested that Lynn's article is aimed in part at raising awareness of the problem and of the DOD's actions in response, particularly "active defense," which seeks out intruders on the network. It is also an exercise in public lobbying for DOD to have a role in national cyberdefense. Current legislative proposals generally give the Department of Homeland Security primary responsibility in that area.