Infected Flash Drive Caused ‘Turning Point’ in Cyberdefense

A previously classified cyberattack on a US military laptop was launched from an infected flash drive containing malicious code. As a result the military and some U.S. government branches have since banned the use of USB drives. (Jung Yeon-Je/Getty Images)

A previously classified cyberattack on U.S. military networks in 2008 was revealed by U.S. Secretary of Defense William J. Lynn III, this week in a Foreign Affairs essay.

The incident “was the most significant breach of U.S. military computers ever, and it served as an important wake-up call,” said Lynn in Foreign Affairs.

He added that “The Pentagon’s operation to counter the attack, known as Operation Buckshot Yankee, marked a turning point in U.S. cyberdefense strategy.”

The attack began when a military laptop was infected by a flash drive which contained malicious code, “placed there by a foreign intelligence agency,” and then spread into the U.S. Central Command network, according to Lynn.

The code then continued to spread undetected throughout the system into areas both classified and unclassified and was able to send the information it collected back to its source.

Lynn added that there have been similar breaches. “Adversaries have acquired thousands of files from U.S. networks and from the networks of U.S. allies and industry partners, including weapons blueprints, operational plans, and surveillance data,” Lynn said in Foreign Affairs, adding that the Pentagon has beefed up its cyberdefense operations under the new U.S. Cyber Command.

The military and some U.S. government branches have since banned the use of USB drives.