Slashdot Mirror
Heathrow Airport Security Files Found on USB Stick In The Street (bbc.co.uk)
"The BBC is reporting a security probe after security data about Heathrow was discovered on a USB found on the street," writes long-time Slashdot readers Martin S. From the article:
The Sunday Mirror reported that the USB stick had 76 folders with maps, videos and documents, including details of measures used to protect the Queen. A man found it in west London and handed it into the paper, it said. Heathrow said all of its security plans had been reviewed and it was "confident" the airport was secure. "We have also launched an internal investigation to understand how this happened and are taking steps to prevent a similar occurrence in future," it said.
The Mirror reports that the USB stick was not encrypted and did not require a password, according to an article shared by Slashdot reader rastos1. Insiders "admitted it sparked a 'very, very urgent' probe, and that it posed 'a risk to national security'."
The Mirror reports that the USB stick was not encrypted and did not require a password, according to an article shared by Slashdot reader rastos1. Insiders "admitted it sparked a 'very, very urgent' probe, and that it posed 'a risk to national security'."
Security only applies to everyone else.
Don't be scared..., be very frightened, but don't be scared.
In the UK, USB sticks with sensitive or secret info always have to be forgotten in an underground car, it's the law.
I believe that it is them who we currently blame for all things like this.
We've seen DVDs lost in the mail, USB sticks left on the bus, on the train, and in taxis. Somewhere in the street is new, though. Now, any bets as to where we'll find accidentally left interesting data next?
Are the police and relevant authorities confident that this was something that was an internal blunder, and not something more sinister? If this was an accidental issue, the person who committed the blunder should be held to account. While I'm hoping that this is the most likely account and thus most probable, I'm not discounting malice of intent from an insider or terrorist. Either way, this really isn't good.
I'm so worried about the baggage retrieval system they have at Heathrow.
Why wasn't the USB key in question a high security, hardware encrypted device? There is no reason to not have a military FIPS-140-2, AES encrypted USB key that can self wipe and self destruct, with full location tracking and remote kill switch.
There is no excuse for files of this importance to be left on a "normal" key. Who ever provided the key and who ever takes care of the systems the files were copied off of, should face criminal charges.
This is exactly the same as dropping a scribbled napkin or leaving a folder in a seat -- just much more information in much smaller of a form factor.
And I'm not really sure what is going to change this. If there's a way to enforce the use of encrypted flash drives, that would help. But even if so it seems like exceptions typically get carved out for big shots who either can't or don't want to deal with extra layers of bother.
the man for found it will face changers and be hit with bill to fix it as damages.
When you have something like this you hand it over to someone who can leak it with no traces back to you.
by the new airport cyber security expert, that used to work at Equifax up until a few months ago.
I'd sooner chew gum found in the street.
Mysterious USB drive discovered and found on the street plugged directly into sensitive heathrow servers, believed to be the cause of all grounded air traffic across Europe.
This is grounds to quit on the spot if you're the CISO.
Security is as good as the weakest link. Usually that weakest link is found in the C-Level and their secretaries. These people know ZERO about IT security but demand full privileges over their systems.
The only reason you don't get to hear about it too often is that they are also the people who would fire people for being incompetent fools who jeopardize security...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Hackers dropped USB sticks for the office workers to found. Today, the government officials and security professionals drop USB sticks in public spaces for the terrorists and criminals to found. They just didn't mean to.
Get used to it!
Boobs in Chaaaarge!
"handed it into the paper"
Neat trick!
Or did they mean "handed it IN TO the paper". Two words - VASTLY different meaning.
A man found it in west London and handed it into the paper
Should read:
A man found it in west London, checked the contents and then hawked it round the gutter press, eventually selling it to the highest bidder.
I wonder if the person who found it is in trouble ?
On the other side of the pond I fear that person would have been arrested and facing life in prison. Hate to be so cynical, but I remember 1 or 2 cases where a person was facing outrageous penalties (Aaron Swartz for one) for doing nothing harmful.
When you have something like this you hand it over to someone who can leak it with no traces back to you.
What in the FUCK is wrong with you? Life isn't some James Bond movie where the good guy always wins. This information is practically a blueprint for a terrorist attack. Think you'll rest easy knowing you were the responsible party who leaked information that ended up taking innocent lives, as if "no traces" is the most important thing here? Wake the fuck up.
When you have something like this you hand it over to the responsible party to prevent a leak. We have enough security breaches in the world driven by ignorance and incompetence. We don't fucking need more driven by stupid asshats who want to pull the pin on the grenade just to see what leaks out.
Sounds sorta familiar.
With a healthy bit of conspiracy thinking, I hope the drive was check and tested on insulated equipment.
https://en.wikipedia.org/wiki/Stuxnet
Granted, it could be good old fashion incompetence, so it should also be tempered with Hanlon's razor.
Where do they find these editors?
"A USB", please, I feel ashamed coming here now. A new low.
Never happened. True story.
What do we call it when security depends on potential attackers just not knowing what measures you've taken?
From where I sit, Heathrow's security has a pretty good record. It's a high profile target with a huge volume and variety of traffic - the world's busiest airport, by some measures - and yet no significant attack has got through it in more than 25 years.
"We have also launched an internal investigation to understand how this happened..."
Let me tell you what happened. Someone dumped the files onto a flash drive and dropped it somewhere.
I object to power without constructive purpose. --Spock
not to plug usb-sticks-found-in-the-street into my computer.
LOL!!!
In other news, an airport security presenter was extremely embarrassed when plugging in his USB stick to find 32gb of child porn.
The Mirror reports that the USB stick was not encrypted and did not require a password, according to an article shared by Slashdot reader rastos1. Insiders "admitted it sparked a 'very, very urgent' probe, and that it posed 'a risk to national security'."
At least we know it was the good guys, because in UK only terrorists use encryption.
My original submission included making the point that only an idiot plugs in a found USB but this has been removed in the edit and my scepticism has been lost.
The reported fact that this was found on the street amongst fallen leaves is highly unlikely and suspicious. It does provide plausible deniability for the journalist over their source, but my money is this will be revealed to be a hoax.
The newspaper that published this story, offers to pay for stories. My belief is that there is a very good chance this will be revealed to be entirely a hoax. A assembly of public source data to get a reward/story bounty from the newspaper.
It is possible, but unlikely this could be a honey trap for the journalist, or anybody with the USB including attack code intended to compromise their PC/Network. This is how STUX worked.
And why did the finder give it to a paper and not to the police (which is what he should have done). I wonder how much money he got from the paper...
A real CISO would find out about the leak, sell and short their stock, make the announcement and make it sound as horrific as possible, take the profits and walk away wealthy.
Who picks up a USB drive they found laying in the street and then proceeds to plug it into their computer to see what's on it?
It wasn't a case of 'national security'.
It would only involve a handful of passengers falling out of the sky.
The state was nowhere at risk.
"Trump!!", the new Godwin.
Simple, using some intel channel they don't want disclosed they discovered or at least were lead to suspect that the security plans were compromised.
UK police or intelligence know that the security methods had to be changed so they sent an agent with the USB drive to a friendly reporter at the paper so they can safely change observable security practices without tipping off whoever the opponent is.
UK police are not interested in minor incidents like found USB drives with national security data or organized child trafficking targeting white girls.
They only deal with real crimes like complaining about the UK being flooded with muzzies or leaving ham sandwiches near mosques.
https://usbkill.com/
this is a site that actually sells working units (and a "filter" gizmo you can test with)
Security only applies to everyone else.
A security architecture / plan should (ideally) be effective even it is known to the enemy, otherwise it's just security by obscurity. So while the having it obscure is useful in that discovery is an extra hoop a attacker has jump through, it shouldn't be relied on.
From TFS:
including details of measures used to protect the Queen.
So...yea...'national security...'
I'm pointing out several plausible alternatives that blow away the assumption that this is real.
The likelihood that this would be 'found' in this way, that it would include sensitive data, that it would not be encrypted all amounts a fail of Occams Razor in a very big way.
The vast majority of lost USB drives will end up lost for ever, swept up in rubbish, buried in decaying leaf litter.
That the device contain sensitive data, that it was found, that it was examined, that this data was unencrypted, that it found its way into the hands of a journalist all stretch the base assumption well beyond braking point.
When asked what would happen to England when Queen Elizabeth II would die, she allegedly answered: "Nothing, the country will just go on." :)
So, no, not really 'national security'.
Note however the 'alleged' part.
"Trump!!", the new Godwin.