Lesson 6

The Parking Lot USB Trap

Physical Security Threats

The Bait

Marcus finds a USB drive in the company parking lot. It's got a label that says "Salary Info 2024 - CONFIDENTIAL". Curious, he plugs it into his work computer to see what's on it.

The drive appears empty. "Weird," Marcus thinks, and goes about his day.

What Marcus doesn't realize: The moment he plugged in that drive, it installed a backdoor giving attackers full access to the company network. The "empty" appearance was intentional - nothing suspicious for Marcus to report.

How USB Attacks Work

AutoRun Malware

Malicious software that executes automatically when the drive is inserted

Rubber Ducky

A device that looks like a USB drive but acts like a keyboard, typing commands at superhuman speed

USB Killer

A device that sends an electrical surge to physically destroy the computer

Data Exfiltration

Malware that copies sensitive files back to the USB drive

The Psychology of the Attack

Attackers label USB drives strategically to increase curiosity:

  • "Salary Information" - Who doesn't want to know what others make?
  • "Layoff List" - Fear drives people to check
  • "Private Photos" - Curiosity is powerful
  • "Project Roadmap" - Seems business-relevant
  • Company logo on the drive - Looks official and safe

Real-World Example

In security tests, researchers dropped 297 USB drives around a university campus. 48% were plugged in, often within minutes of being found. People genuinely wanted to return them to their owners - but curiosity led them to check the contents first.

Safe Practices

1
Never Plug in Unknown USB Drives

Treat found drives like you'd treat a random syringe - don't touch it

2
Turn Found Drives in to Security

They have safe ways to examine suspicious devices

3
Disable AutoRun on Your Computer

Prevents automatic execution of USB malware

4
Be Suspicious of "Gifts"

Free USB drives at conferences or from vendors could be compromised

Test Your Knowledge

Answer these questions to complete the lesson.

1. Marcus found a USB drive labeled 'Salary Info 2024.' What should he have done?

2. What is a 'Rubber Ducky' in security terms?

3. Why do attackers label USB drives with tempting names like 'Confidential' or 'Salary Info'?

4. You receive a free USB drive with your company's logo at a trade show. Is it safe to use?