Pentagon office left military designs for body armor, vehicle gear open to hackers, watchdog finds

The vulnerabilities could have allowed adversaries to understand technology produced for the battlefield.

The office in charge of the U.S. military’s 3D printing left designs for defense technology vulnerable to theft by hackers and adversaries, according to a watchdog report made public on Wednesday.

If left unfixed, the security gaps could lead to a number of nightmare scenarios, including adversaries stealing military designs, compromising Department of Defense networks or even introducing flaws into design data that could make its way into battlefield products, the report’s authors concluded. Designs included blueprints for protective body armor, tactical vehicle gear, weapons systems brackets and prosthetic body parts, according to the report.

The report found that officials were unaware that the systems connected to local networks and the internet. Because the systems were miscategorized, the office failed to conduct a risk assessment required by the department altogether. Officials also failed to monitor removable media entering the systems.

The security gaps would have left a plethora of entry points for hackers. As DHS’ Cybersecurity and Infrastructure Security Agency warns, removable media such as USB drives provide hackers an inexpensive and portable way to infect computers with malware.

Although the Defense Department’s chief information officer disagreed with several recommendations, actions planned by individual offices sufficiently meet the intent of the recommendations, according to the office of the Inspector General. The DoD office in charge of the components manufacturing agreed to update all computer operating systems to the most recent version required by the DoD.

Pentagon officials also missed basic maintenance on systems, including failing to patch a 2019 vulnerability that would have allowed attackers to use unauthorized access to a single computer to jump into others within the network, according to the report. Of the 46 computers attached to the printing tools, 35 hadn’t been updated for more than five years putting the computers and printers connected to them at risk.

Part of the problem was that individuals working with the technology failed to understand how the printers, which the military has ramped up investments in over the past five years, differed from traditional production tools.

“Navy FRC‑SW engineers stated that they treated the AM systems as other manufacturing machines, such as milling and welding machines that did not require consideration of cybersecurity,” the report noted.

The report recommends that the DoD chief information officer require the systems to establish and immediately implement security controls.

Government

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure