Unencrypted USB stick with 2.5GB of data detailing airport security found in street

If you were to see a USB flash drive just lying in the parking lot at work, then it would be a good bet that the USB stick was part of a pen tester’s trick to get inside a company’s network or a company’s test to determine which employee plugged it into a work PC and needs to attend awareness training. But a recently found USB memory stick, which not found in a parking lot but on a road, has caused one of the world’s busiest airports to launch an internal investigation as the USB drive contained confidential information that posed “a risk to national security.”

Heathrow Airport in London launched a “very, very urgent” investigation on Sunday after a man found a USB flash drive with detailed sensitive information about the airport’s security and anti-terror measures. The USB stick, which contained 2.5GB of data, was neither encrypted nor required a password to access it.

The USB drive was reportedly found in leaves on the street by an unemployed man; he plugged it in at a library where he was using a PC to search for a job. The USB stick contained 76 folders, packed with maps, documents and videos, even security measures to protect the Queen and the route she takes when using the airport. He did not hand the drive over to police, but to the Daily Mirror.

At least 174 documents – some marked as “restricted” or “confidential” – were included in the 76 folders. The USB stick also contained maps, information showing how to access restricted areas such as tunnels and escape shafts as well as files on every type of ID needed to access those areas –“even those used by covert cops.”

It also mapped the location of CCTV cameras, routes used by British and foreign politicians and a timetable of security patrols guarding against suicide bombers and terror attacks.

The USB stick contained the route to the Royal Suite, the screening process at the Windsor Suite, listed those who are “exempt from screening” and even contained the radio codes to be used in case of an “aircraft hijacking.”

Other files included “details of the ultrasound radar system used to scan runways and the perimeter fence,” satellite images and operating manuals for the Doppler radar surveillance system as well as photos of X-ray machines and scanning equipment.

Since none of the data was encrypted, it was all accessible by anyone who had possession of the USB. So, was this a colossal lapse of security or did someone intend for the information to be released to the public?

The Daily Mirror quotes an unnamed expert who suggested the USB stick “is serving up intelligence on a plate to people” and the information could be helpful to future attackers.

Unnamed airport insiders told the newspaper that the USB stick “sparked a ‘very, very urgent’ probe and that it posed ‘a risk to national security’.”

However, the official statement by a Heathrow spokesperson claimed, “We have reviewed all of our security plans and are confident that Heathrow remains secure. We have also launched an internal investigation to understand how this happened and are taking steps to prevent a similar occurrence in future.”

This article was originally posted on CSOonline.com on Oct 30, 2017.