2008 cyberattack on United States

The 2008 cyberattack on the United States was a malicious attack done by foreign actors on the United States Department of defense. Described as the "worst breach of U.S. military computers in history", the defense against the attack was named "Operation Buckshot Yankee". It led to the creation of the United States Cyber Command.[1][2][3]

History

It started when a USB flash drive infected by a foreign intelligence agency was left in the parking lot of a Department of Defense facility at a base in the Middle East. It contained malicious code and was put into a USB port from a laptop computer that was attached to United States Central Command. From there it spread undetected to other systems, both classified and unclassified.[1][2]

Operation Buckshot Yankee

The Pentagon spent nearly 14 months cleaning the worm, named agent.btz, from military networks. Agent.btz, a variant of the SillyFDC worm,[4] has the ability "to scan computers for data, open backdoors, and send through those backdoors to a remote command and control server."[5] It was suspected that Russian hackers were behind it because they had used the same code that made up agent.btz before in previous attacks. In order to try to stop the spread of the worm, the Pentagon banned USB drives, and disabled Windows autorun feature.[5]

gollark: Indeed.
gollark: I mean, videos need lots of bandwidth and all, but if you don't expect more than a few people at a time to watch it it's not much of an issue.
gollark: You can just host videos yourself on a VPS/home server or something if you don't plan on high traffic and don't want its ad revenue/promotion.
gollark: The rules say "no talking about making it", not "no having pictures of exploding things".
gollark: mono's for .NET programs.

References
  1. "Defense Department Confirms Critical Cyber Attack". Eweek. August 25, 2010. Retrieved 2010-08-25. A senior Pentagon official has revealed details of a previously-classified malware attack he declared "the most significant breach of U.S. military computers ever." In an article for Foreign Affairs, Deputy Defense Secretary William J. Lynn III writes that in 2008, a flash drive believed to have been infected by a foreign intelligence agency uploaded malicious code onto a network run by the military’s Central Command. ...
  2. William J. Lynn III. "Defending a New Domain". Foreign Affairs. Retrieved 2010-08-25. In 2008, the U.S. Department of Defense suffered a significant compromise of its classified military computer networks. It began when an infected flash drive was inserted into a U.S. military laptop at a base in the Middle East. The flash drive's malicious computer code, placed there by a foreign intelligence agency, uploaded itself onto a network run by the U.S. Central Command. That code spread undetected on both classified and unclassified systems, establishing what amounted to a digital beachhead, from which data could be transferred to servers under foreign control. It was a network administrator's worst fear: a rogue program operating silently, poised to deliver operational plans into the hands of an unknown adversary.
  3. Knowlton, Brian (August 25, 2010). "Military Computer Attack Confirmed". The New York Times. Retrieved 2010-08-26.
  4. Shachtman, Noah (November 19, 2008). "Under Worm Assault, Military Bans Disks, USB Drives". Wired.
  5. Shachtman, Noah. "Insiders Doubt 2008 Pentagon Hack Was Foreign Spy Attack (Updated)". Retrieved 2016-10-04.

Further reading
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.