A hacker stole US drone and tank documents because nobody changed the default router password

A hacker stole US drone and tank documents because nobody changed the default router password

As long as people continue to ignore critical security patches and do not change the default passwords on their devices, high-profile hacks like this one will remain common and could have lasting consequences.

A computer hacker was able to infiltrate the computer network of a Nevada Air Force base because nobody changed the default password of a Netgear router on its network. The hacker then made off with sensitive documents about the Air Force's MQ-9 Reaper drone and put them up for sale on a dark web marketplace.

The documents were discovered online by security research firm  Recorded Future who spoke with the hacker to confirm their validity. They determined the breach took place as a result of a well known Netgear Router Vulnerability and a default FTP password on that router.

The stolen documents themselves are not classified, but could still pose a security threat if they fell into the wrong hands.

To find the vulnerable router, the hacker used a service called Shodan which is essentially a search engine for finding internet connected devices around the world. There are still thousands of routers online that are still vulnerable to this type of attack.

Once the attacker found the device, it was trivial to compromise it since the IT department at the Air Force base had not patched the router. From here, the attacker gained access to the router's root directory and the ability to remotely execute commands. This gave the hacker access to the computer of the Officer in Charge at the base and all the documents on it. Ironically, one of the documents the hacker exfiltrated showed that the Officer had recently completed a "Cyber Awareness Challenge."

Upon further questioning, the hacker also offered up documents on IED defenses, M1 Abrams tank operation, tank tactics, and more. It's not clear where these documents came from, but based on the information they contain, it's likely they were stolen from the Pentagon or a US Army official.

The government is aware of the leak and is investigating. Although they believe they have the hacker's name and country of origin, they haven't made that information public.