The computer virus that has poxed the United States Air Force drone fleet appears to be a type routinely used to steal credentials from players who play Mafia Wars online. According to unofficial reports, drone command caught an Internet cold.

The USAF suffered a slight twinge of embarrassment when the public discovered that the unmanned drone fleet had become infected with a keylogger virus. In a statement today, a military official acknowledged the presence of the virus and gave some extra details as to its apparent origin and composition.

No news yet to exactly how the virus infiltrated the systems of Creech Air Force Base—the on-location remote control facility for the drone operators—but the U.S. military would certainly like to impress upon everyone that the outbreak has merely been a nuisance and has not affected their operations at all. Although earlier reports suggest that they’ve been unable to completely remove the virus as reinfection keeps returning after they attempted it to clear it out.

Wired picked up the unofficial reports and some news out of the Associated Press to paint the picture,

[T]he Air Force did provide a few details about the malware. They said it was first noticed on “a stand-alone mission support network using a Windows-based operating system.” And they called it “a credential stealer,” transmitted by portable hard drives. (Security specialists had previously identified it as a program that logged pilots’ keystrokes.) “Our tools and processes detect this type of malware as soon as it appears on the system, preventing further reach,” the Air Force added.

The malware “is routinely used to steal log-in and password data from people who gamble or play games like Mafia Wars online,” noted the Associated Press, relying on the word of an anonymous defense official. That official did not explain why drone crews were playing Mafia Wars or similar games during their overseas missions.

Of course, the drone pilots need not have been playing Mafia Wars on their remote consoles in order to infect the drones. They could have been playing the games off campus, infected some fashion of removable media (like a USB mass storage device), and carried it back. There could also have been some sort hole through the air-wall between the drone command and the outside world that permitted an infected document containing the virus through.

This sort of snafu reveals that drone command needs to double-up on their virus scan protocols. Documents that pass over the air-wall between the outside world and the drones need to be vetted at the point creation, tagged with cryptographic signatures, and then double-checked before they’re inserted into the drones. In fact, any time a storage device passes across that air-wall it should have been scanned thoroughly by virus checkers and the cryptographic signatures should be on a separate, disconnected drive so that they cannot be tampered with at the same time.

It’s not at all shameful that a virus got onto the removable drives. Go outside and you run the risk of catching the flu. The real embarrassment here is that the Air Force immune system didn’t see it walking in the front door. If what amounts to an Internet rhinovirus (i.e. the common cold) made it into the drone command something a great deal smarter and well orchestrated could make use of the exact same loophole.