欢迎再次收看PWNED，这是我们每周专栏，专门关注那些犯下严重安全错误的组织。通常，我们谈论的是企业，或者偶尔出错的学校，但今天我们要写的是世界上最强大的军队中发生的一起严重IT失误。如果您知道有人在其网络中留下了巨大漏洞的故事，欢迎通过pwned@sitpub.com与我们分享。如需匿名，可应要求提供。
Welcome, once again, to PWNED, the weekly column where we gawk at organizations that have made serious security mistakes. Normally, we’re talking about businesses or maybe the odd school that messes up, but today we’re writing about a serious IT screwup in the world’s most powerful military. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com.
今天的故事来自SolarWinds这家IT监控和服务公司的首席信息安全官Justin Henkel。Henkel此前曾在空军从事IT安全工作，而在2000年代初的一天，他目睹了一种如今根本无法容忍的做法。在U盘尚未普及之前，用CD刻录任务数据是常规操作，这些光盘随后被同时放入非密级和密级系统中。“他们会刻录一张CD，然后取出这张CD，放入密级系统，完成剩余的任务规划，”Henkel告诉我们。
Anonymity is available upon request. Today’s tale comes from Justin Henkel, the CISO of IT monitoring and service company SolarWinds. Henkel previously worked in IT security for the Air Force and one day in the early 2000s saw a practice that just wouldn’t fly today. Before USB drives became popular, burning CDs with mission data was the modus operandi, and those discs were put in both unclassified and classified systems.
“随后，他们又会取出这张光盘，放入飞机内。”在飞机内，CD中的数据将帮助飞行员导航，并包含他们可能遇到的威胁信息。后来，随着U盘的普及，飞行员开始使用U盘而非光盘。“他们并没有真正考虑过密级和非密级系统之间的整体影响，”Henkel谈到飞行员时说。“他们使用同一设备在两种系统之间切换，却未意识到可能通过U盘读写恶意软件。[他们]并未真正理解整体威胁图景。”
“They would write a CD, and then they would take that CD and then put it in a classified system and do the remainder of the mission planning,” Henkel told us. “Then they would take that disc and then put it in the airplane.”Inside the airplane, the data on the CD would help the pilot navigate and contain information about threats they might encounter. Later, when thumb drives became a thing, pilots used them instead of discs. “They didn't really think about the overall impact of classified versus unclassified systems,” Henkel said of the pilots.
根据Henkel的说法，空军人员会从当地供应商处购买闪存盘，而不是从官方军方承包商处采购。如果他们当时在阿富汗，这些U盘很可能 literally 来自喀布尔的一家商店。而且这绝非相当于百思买。“将一台基于美国的电脑带入该国，比直接在当地购买更为困难，”他表示。
“Using the same device for both, they didn’t understand that you could read and write onto a USB drive with malware. [They were] not really understanding the overall threat picture.”According to Henkel, Air Force personnel would buy their flash drives from local vendors rather than sourcing them from official military contractors. If they were in Afghanistan, those drives could literally come from a store in Kabul. And it wasn’t exactly the equivalent of Best Buy.
“他们只是去喀布尔当地市场或他们所在的任何城市。我过去常这样做：出去，与当地供应商建立关系。‘嘿，我需要100个U盘。’”不幸的是，美国的敌人注意到了这一点，并很快开始在中东向当地供应商出售被感染的U盘。亨克尔知道，在分类系统中使用偷运网（sneakernet）就是在酿造灾难。只是没有人愿意听他说。
“It was more difficult to bring a US-based computer into the nation than it was just to buy local,” he said. “So they were just going out into the local market in Kabul or whatever city that they were out [in]. And I used to do this: go out, make relationships with the local vendors. ‘Hey I need 100 USB sticks.’”Unfortunately, enemies of the US noticed and soon started selling infected USB drives to local vendors in the Middle East. Henkel knew that using a sneakernet with classified systems was a recipe for disaster.
“这真是个震惊，”他告诉我们。“我当时才22岁，在整个军衔体系中职位很低，却试图告诉上校和少校他们所做的事情是违规的。”2008年，美国国防部因有人将感染的U盘插入连接到美国中央司令部的笔记本电脑而被恶意软件感染。这种蠕虫被命名为Agent.BTZ，能够从感染的计算机中收集信息并与远程服务器通信。2016年，FBI和国土安全部的一份报告将该恶意软件归因于一个或多个俄罗斯组织。
It’s just that no one would listen to him. “It was just a shock,” he told us. “I was a young 22-year-old guy, very junior in the overall rank system, trying to tell colonels and majors that what they’re doing is a violation.”In 2008, the US Department of Defense was infected by malware after somebody attached an infected USB flash drive to a laptop with access to US Central Command. The worm, dubbed Agent.BTZ, could collect information from infected computers and communicate with remote servers.
五角大楼花了14个月才从其系统中彻底清除该恶意软件。正是这次攻击促使五角大楼在2008年意识到问题并禁止使用U盘，而是强制数据传输通过更安全的系统进行。最终，在2010年，U盘在特定情况下被允许再次使用。®
A 2016 report from the FBI and DHS attributed the malware to one or more Russian groups. It took the Pentagon 14 months to scrub it from its systems. It took this attack for the Pentagon to wise up in 2008 and ban the use of USB drives, instead forcing data transfers to go through more secure systems. Eventually, in 2010, the drives were allowed again under certain circumstances. ®