US military manuals hawked on dark web after files left rattling in insecure FTP server

Wow, so servicemen forget to change their default logins too

MQ-9 Reaper manuals were among the leaked documents

Sensitive US Air Force documents have leaked onto the dark web as part of an attempted sale of drone manuals.

Threat intel firm Recorded Future picked up on an auction for purported export-controlled documents pertaining to the MQ-9 Reaper drone during its regular work monitoring the dark web for criminal activities last month. Recorded Future’s Insikt Group analysts, posing as potential buyers, said they’d engaged the newly registered English-speaking hacker before confirming the validity of the compromised documents.

Further interactions allowed analysts to discover other leaked military information available from the same threat actor. The hacker claimed he had access to a large number of military documents from an unidentified officer.

These documents included a M1 Abrams tank maintenance manual, a tank platoon training course, a crew survival course, and documentation on improvised explosive device mitigation tactics.

Subsequent work revealed that this info was actually pulled from at least one and more likely a series of insecure File Transfer Protocol (FTP) servers. “The attacker used a widely known tactic of gaining access to vulnerable Netgear routers with improperly setup FTP login credentials,” Recorded Future said.

Two years ago researchers warned that Netgear routers with remote data access capabilities were susceptible to attack if the default FTP authentication credentials were not updated. Despite the stretch of time, it’s still a common issue. During its research, Recorded Future identified more than 4,000 routers susceptible to attack.

Dark web market drone ad

Exploitation was far from difficult. Utilising Shodan’s machine data search engine, the hacker scanned large segments of the internet for high-profile misconfigured routers that use a standard port 21 to hijack all valuable documents from compromised machines.

The captain, whose computer had seemingly been compromised recently, had completed a cybersecurity awareness course, but he did not set a password for an FTP server hosting sensitive files. This allowed the hacker to easily download the drone manuals, said the researchers. The precise source of other the other dozen or so manuals the hacker offered for sale remains undetermined.

“The source was never disclosed to Recorded Future. However, judging by the content, they appear to be stolen from the Pentagon or from a US Army official.”

The hacker let slip that he was also in the habit of watching sensitive live footage from border surveillance cameras and airplanes. “The actor was even bragging about accessing footage from a MQ-1 Predator flying over Choctawhatchee Bay in the Gulf of Mexico.”

Researchers identified the “name and country of residence” of an individual associated with a group it reckons is responsible for the illicit sale of US military manuals. Recorded Future has not identified the country responsible but said that it is continuing to “assist law enforcement in their investigation” of the trade in classified documents.

Early indications suggest a single hacker or small group of associates, rather than organised crime or state-sponsored hackers.

All sorts of bad stuff – including personal information – is hawked through dark web bazaars but classified material is seldom offered. Recorded Future said the latest case is almost unprecedented.

“It is not uncommon to uncover sensitive data like personally identifiable information, login credentials, financial information, and medical records being offered for sale on the dark web. However, it is incredibly rare for criminal hackers to steal and then attempt to sell military documents on an open market.” ®

Sponsored: Minds Mastering Machines – Call for papers now open