How did Kabul store-bought USBs breach Air Force air gaps in Afghanistan?
Former Air Force security staff reveal how personnel used commercially bought removable media for mission planning in Afghanistan, bridging air gaps with malware risks.
Key points
- Pilots used the same USB drives on both unclassified and classified systems, creating a bridge for potential malware.
- Flash drives were purchased from local vendors in Afghanistan, such as stores in Kabul, rather than official military contractors.
- Justin Henkel, SolarWinds CISO and former Air Force security staff, described this practice from the early 2000s as a significant oversight.
The short version
- Personnel bypassed official supply chains by buying flash drives from local shops in conflict zones like Afghanistan.
- The same removable media was inserted into unclassified workstations and classified mission-planning systems.
- This cross-contamination allowed malware to potentially move between security domains, according to former Air Force CISO Justin Henkel.
The details
Justin Henkel, currently the CISO at SolarWinds, previously worked in IT security for the US Air Force. He observed practices in the early 2000s that would be unacceptable in modern security postures. Before USB drives became standard, pilots burned mission data onto CDs. They would write data on an unclassified system, move the disc to a classified system for final planning, and then load it into the aircraft for navigation and threat information.
When thumb drives replaced optical discs, the workflow remained similar but introduced new risks. Henkel noted that pilots did not fully grasp the impact of using the same device across classified and unclassified environments. They failed to understand that malware could be read from and written to a USB drive, effectively bridging the air gap between networks. This lack of awareness meant the threat picture was not fully understood by the personnel handling the media.
The context
According to Henkel, Air Force personnel often sourced their flash drives from local vendors rather than official military contractors. In Afghanistan, these drives could be purchased directly from stores in Kabul. Henkel pointed out that importing US-based computers into the nation was more difficult than simply buying local hardware. Consequently, the supply chain for these critical storage devices was unvetted and potentially compromised, differing significantly from controlled domestic procurement like Best Buy.
Next steps
Organisations should review their removable media policies to ensure strict separation between security domains. Teams must verify that all storage devices are sourced from approved vendors and scanned before use. Legacy practices that allow cross-contamination between unclassified and classified systems need immediate remediation. Training should emphasise the risk of malware bridging air gaps via physical media.
What defenders should look for
Teams usually monitor endpoint logs for unexpected removable storage connections, especially on isolated or classified networks. Check whether any device has been inserted into multiple security zones without sanitisation. Look for alerts indicating mass storage activity on systems that should not accept external media. Investigate any sudden file transfers or execution of scripts from USB roots. Contain the device immediately if anomalies appear, and isolate the affected endpoint to prevent lateral movement. Review access logs to determine if sensitive data was exfiltrated or if malicious code was introduced via the physical bridge.
What to do and how to stay safe: SolarWinds
- Enforce strict policies prohibiting the use of personally purchased or unvetted removable media on any corporate or government network.
- Implement technical controls that block unauthorized USB devices and require authentication for storage access on sensitive systems.
- Scan all removable media in a quarantined environment before connecting it to operational networks to detect malware.
- Train staff on the risks of cross-contamination between classified and unclassified systems using physical storage devices.
Step-by-step guide: Immutable Backups: Stop Ransomware Deleting Your Data Copies
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who revealed the practice of using unvetted USB drives in the Air Force?
Justin Henkel, the CISO of SolarWinds and former Air Force IT security staff, described the practice.
Where did the pilots buy their flash drives?
They purchased them from local vendors, including stores in Kabul, Afghanistan, rather than official contractors.
What was the primary security risk identified?
Using the same device on classified and unclassified systems allowed malware to bridge the air gap between networks.
