US defence workers lose USB privileges

THE US DEPARTMENT of Defense has issued rules against the use of removable drives within the US Armed Forces in an attempt to curb virus and malware infections of the Sipper and Nipper networks. The Department acted in reaction to the threat of a “global virus” which was later identified as the Agent.btz worm, a little worm that specifically seeks out removable media for propagation.

Initial reports indicate the DoD has formed flash-drive collecting battalions and recalled all the drives that were issued to employees. Further probing into the matter indicates that US military bases throughout have also received notice that this is also valid for GI Joe/Jane: no removable media use allowed on bases – including precious iPlods and other MP3 players (we wonder what that does to troop morale?).

Several armed forces throughout the world already implement similar measures, including the Israeli Defense Forces, according to our resident towel-donning military affairs expert Sylvie Barak.

We’re a bit at a loss as to why the SIPRNet and NIPRNet anti-virus scanners wouldn’t pick up the malware on removable media drives, but if they aren’t capable of the most simple AV tasks, we’d recommend banning email and any sort of internet communication altogether, resorting to carrier pigeons as the only true form of military communication.

What does sound a bit more reasonable is the fact that several serious data loss incidents have occurred over the course of 2008, including a USB stick that was stolen in Japan but contained data pertaining to joint strategic US/Japanese SDF troop deployments. The stick was later retrieved, but the fact that it was 'lost' in the first place did raise some eyebrows.

Regardless of these facts, big corporations usually issue employees serialised thumb-drives, so if in fact a leak or infection occurs the employee will be traced in no time. Another option is to simply reduce user privileges so as to not be able to install the USB drive's drivers, most admins already do this to cut down on their monthly aspirin budget. Windows 2000 did that some, uhm, eight years ago… (and even before that if USB drives were around).

We’re as partial to a conspiracy theory as the next person, and touting the DoD’s network insecurity can be a great way of getting the newly-elected US President to give a good long look at what’s going on in the (cyber)world, and boosting the Cybercommand budget.

We hear they’re investing in something called SkyNET. µ