The Bait
Marcus finds a USB drive in the company parking lot. It's got a label that says "Salary Info 2024 - CONFIDENTIAL". Curious, he plugs it into his work computer to see what's on it.
The drive appears empty. "Weird," Marcus thinks, and goes about his day.
What Marcus doesn't realize: The moment he plugged in that drive, it installed a backdoor giving attackers full access to the company network. The "empty" appearance was intentional - nothing suspicious for Marcus to report.
How USB Attacks Work
AutoRun Malware
Malicious software that executes automatically when the drive is inserted
Rubber Ducky
A device that looks like a USB drive but acts like a keyboard, typing commands at superhuman speed
USB Killer
A device that sends an electrical surge to physically destroy the computer
Data Exfiltration
Malware that copies sensitive files back to the USB drive
The Psychology of the Attack
Attackers label USB drives strategically to increase curiosity:
- "Salary Information" - Who doesn't want to know what others make?
- "Layoff List" - Fear drives people to check
- "Private Photos" - Curiosity is powerful
- "Project Roadmap" - Seems business-relevant
- Company logo on the drive - Looks official and safe
Real-World Example
In security tests, researchers dropped 297 USB drives around a university campus. 48% were plugged in, often within minutes of being found. People genuinely wanted to return them to their owners - but curiosity led them to check the contents first.
Safe Practices
Treat found drives like you'd treat a random syringe - don't touch it
They have safe ways to examine suspicious devices
Prevents automatic execution of USB malware
Free USB drives at conferences or from vendors could be compromised