4 ms·

I have long noticed that Quizlet is a repository for a lot of information that shouldn't be online... from test answers to proprietary line-of-business stuff (e

I have long noticed that Quizlet is a repository for a lot of information that shouldn't be online... from test answers to proprietary line-of-business stuff (ex. retail training materials) to security related stuff (security trainings, emergency response codes). But I would have thought the military would be smart enough not to use it (at all--private or public, it is not in any way designed to handle classified or FOUO data). For example, this one appears to list a number of installations that hold various critical networking infrastructure as well as the names of various admins. https://quizlet.com/414907821/eiws-study-guide-here-it-is-bois-and-gals-flash-cards/ https://quizlet.com/414907821/eiws-study-guide-here-it-is-bo...

tablespoon 5y ago
I doubt these were official DoD flashcard decks. They were probably created individually by different soldiers/airmen to help them study for some test they had to take.
- morpheuskafka 5y ago
  Yeah, I understand that. But I mean as members of the military who are trained and indoctrinated into OPSEC and information handling practices, I would expect them to have made a better decision.
  - jrockway 5y ago
    Hey, at least we didn't find the flashcards for their OPSEC test!
    - nraynaud 5y ago
      Shit, I was thinking along the same line: for any question regarding the OPSec of those people, please search the relevant flash cards.
tgsovlerkhgsel 5y ago
One of the flash cards is "Define opsec". I wish I could add an annotation "not uploading your flashcards to a publicly accessible site".
herewulf 5y ago
Sites like Quizlet get used routinely to cheat on mandatory military training. Copying/pasting the exact text of a test question into a Google search usually turns up quite a few hits of the answers. I'm only familiar with this being used for really mundane training, so OPSEC and FOUO[1] info being posted is surprising. [1]: For Official Use Only, which was recently changed to CUI (Controlled Unclassified Information).
- morpheuskafka 5y ago
  It seems like a lot of them contain largely public info from unclassified manuals, but also have a few base-specific things thrown in that cause the problem. For example [1] is basically a standard police academy study guide, but it also has the names of which armored car services are allowed entry to post, which parking lots are used for storage of nuclear materials during Safe Haven event, [2] has real world and exercise countersigns mixed in with non-sensitive form names and acronyms. Another one had a list of duress words (all named after spices), though it says these are changed every six months. A lot of stuff you could guess easily but still identifies weaknesses (ex. school buses can get on base with a district badge, which is nowhere near as hard to copy as a CAC). [3] has the location of a SCIF. Some other ones had room numbers of buildings containing information networking infrastructure (no public map, but googling the building number returned a picture of the facility from the architect's site). I'm not military, so I'm curious how big of a deal this is relatively? Like is this stuff that a credible attacker could easily find out anyway or is it actually a major weakness? [1]: https://quizlet.com/411678831/qc-questions-flash-cards/ https://quizlet.com/411678831/qc-questions-flash-cards/ [2]: https://quizlet.com/347943371/bdoc-flash-cards/ https://quizlet.com/347943371/bdoc-flash-cards/ [3]: https://quizlet.com/478059813/iec-qc-flash-cards/ https://quizlet.com/478059813/iec-qc-flash-cards/

tablespoon 5y ago

I doubt these were official DoD flashcard decks. They were probably created individually by different soldiers/airmen to help them study for some test they had to take.

morpheuskafka 5y ago
Yeah, I understand that. But I mean as members of the military who are trained and indoctrinated into OPSEC and information handling practices, I would expect them to have made a better decision.
- jrockway 5y ago
  Hey, at least we didn't find the flashcards for their OPSEC test!
  - nraynaud 5y ago
    Shit, I was thinking along the same line: for any question regarding the OPSec of those people, please search the relevant flash cards.

tgsovlerkhgsel 5y ago

One of the flash cards is "Define opsec". I wish I could add an annotation "not uploading your flashcards to a publicly accessible site".

herewulf 5y ago

Sites like Quizlet get used routinely to cheat on mandatory military training. Copying/pasting the exact text of a test question into a Google search usually turns up quite a few hits of the answers. I'm only familiar with this being used for really mundane training, so OPSEC and FOUO[1] info being posted is surprising. [1]: For Official Use Only, which was recently changed to CUI (Controlled Unclassified Information).

morpheuskafka 5y ago
It seems like a lot of them contain largely public info from unclassified manuals, but also have a few base-specific things thrown in that cause the problem. For example [1] is basically a standard police academy study guide, but it also has the names of which armored car services are allowed entry to post, which parking lots are used for storage of nuclear materials during Safe Haven event, [2] has real world and exercise countersigns mixed in with non-sensitive form names and acronyms. Another one had a list of duress words (all named after spices), though it says these are changed every six months. A lot of stuff you could guess easily but still identifies weaknesses (ex. school buses can get on base with a district badge, which is nowhere near as hard to copy as a CAC). [3] has the location of a SCIF. Some other ones had room numbers of buildings containing information networking infrastructure (no public map, but googling the building number returned a picture of the facility from the architect's site). I'm not military, so I'm curious how big of a deal this is relatively? Like is this stuff that a credible attacker could easily find out anyway or is it actually a major weakness? [1]: https://quizlet.com/411678831/qc-questions-flash-cards/ https://quizlet.com/411678831/qc-questions-flash-cards/ [2]: https://quizlet.com/347943371/bdoc-flash-cards/ https://quizlet.com/347943371/bdoc-flash-cards/ [3]: https://quizlet.com/478059813/iec-qc-flash-cards/ https://quizlet.com/478059813/iec-qc-flash-cards/