DoD confirms computer virus in networks - Air Force News | News from Afghanistan & Iraq - Air Force Times

DoD confirms computer virus in networks

The Defense Department confirmed Friday that a virus has infected some of its computer networks but declined to identify the infection, say whether it was a direct attack on the networks or confirm published directives that ban the use of portable storage media such as thumb drives.

“We are aware of a global virus for which there are some public alerts,” said Bryan Whitman, Pentagon spokesman. “And we’ve seen some of this on our networks. We’re taking steps to identify and mitigate the virus.”

Whitman wouldn’t characterize the infection further except to call it a “global issue” that also is affecting worldwide networks outside the Defense Department.

He also declined to confirm a ban on the use of thumb drives, although the ban was spelled out in at least two recent Air Force directives, one of which says the order comes from the Defense Department command that oversees the military computer domains shared by all the services.

Whitman also would not comment on whether officials think the infection may have been transmitted to the military’s networks by way of a thumb drive or other flash media.

“We don’t discuss specific defensive measures that we’re taking or may be taking to protect and defend our networks,” Whitman said.

He called cyberspace a “warfighting domain that’s critical to our operations. And we have to protect it.”

He said military computer network intruders range from recreational hackers to “cyber vigilantes,” ideologically motivated attackers and “transnational actors and national states” that probe the department’s networks “millions” of times daily.

Neither Air Force directive details why the ban on portable digital media was imposed throughout the Defense Department’s Global Information Grid, which includes more than 17,000 local- and regional-area networks and approximately 7 million individual computers.

But the thumb drive ban outlined in the directives was clearly in reaction to a network intrusion, one computer security expert said.

“If it’s preventive, why wasn’t it preventive last week?” said Bruce Schneier, renowned security expert and chief security technology officer for BT, a British-based global communications firm. “Something happened, and they’re worried about it propagating.”

“They’ve got something they need to deal with,” Schneier said. “And they can deal with it better if things don’t move in and out of network. The problem with things like USB sticks is that they’re off-line storage.”

The Internet security firm Symantec reported Nov. 19 that it has noticed an increase in malicious applications that use USB flash drives to spread. The malicious code most commonly being spread in this manner, the firm says, is the SillyFDC worm.

Worms are similar to viruses. According to the Web site 2Spyware.com, the SillyFDC worm is relatively harmless, “designed only to spread and … does not contain any destructive payload.”

Neither of the Air Force directives stated explicitly that a department-wide ban is in place. But one noted that the order to stop using flash media was issued by U.S. Strategic Command, which is responsible for operating and defending the .mil and .smil domains.

That memo, directed at Washington, D.C., Air Force offices and dated Nov. 17, ordered “immediate suspension” of the use of such devices on all NIPR and SIPR networks.

A similar message, which did not mention StratCom, was posted online by Whiteman Air Force Base, Mo.

“The Chief of Staff of the Air Force recently implemented a policy prohibiting the use of memory sticks, thumb drives, flash memory cards such as XD, SD, Micro, Mini, CF, MS, cards etc., cameras, portable music players and [Personal Digital Assistants],” the message states. “Excluded are Blackberry devices that do not have the flash memory such as a Micro SD card installed.

“All remaining removable media such as external hard drives, CDs or DVDs, and other various items can be used if the following policies are met: All removable media must be labeled with the appropriate security classification. All other removable media such as external hard drives, CD/DVD reader/writer items must be scanned with a virus scanner prior to use.”

StratCom, and its Joint Task Force-Global Network Operations, which manages the Global Information Grid, would not comment.

READ MORE: Previous story