The found-USB ploy: from parking-lot bait to BadUSB and surge attacks
A bare USB drive lying in a parking lot is one of the oldest baits in computer security, and it still works. In 2016 a team from Google and the University of Illinois Urbana-Champaign measured exactly how well. This piece looks at where the found-USB ploy came from, what that field experiment actually found, what modern bait hardware can do, and which defensive rules hold up.
From office worms to air-gapped plants
Malware that rides on removable media predates most people's awareness of it. The Sality virus was first detected in 2003, and shortcut-based worms that copy themselves onto drives and wait for the next victim became permanent background noise. Kaspersky's researchers counted 113.8 million removable-media detections in 2017 alone, driven largely by LNK shortcut families that launch as soon as a user clicks the file they mimic. The ploy entered a different class in 2010, when Stuxnet was discovered inside a nuclear enrichment facility that had no internet connection; USB drives were among the ways it crossed the gap. The Windows LNK flaw it exploited, CVE-2010-2568, was patched in March 2015, yet Securelist reported it still ranking among the top drive-root threats years later. Sophisticated groups including Equation, Flame and Regin used the same channel against isolated networks. It is from this era that the thumb-drive-in-the-parking-lot scene became stock imagery in fiction, echoed on television by series such as Mr. Robot in 2015.The dropped-stick experiment
The paper Users Really Do Plug in USB Drives They Find, presented at the 2016 IEEE Symposium on Security and Privacy by Matthew Tischer and colleagues from Google and the University of Illinois Urbana-Champaign, scattered 297 drives across the campus. The authors estimated that 45 to 98 percent were plugged in, depending on the drive's condition. And finders rarely stopped at plugging in: the study's companion blog reports that 48 percent of the drives were connected and had at least one file opened. The first drive was connected in under six minutes. A fifth of the connections happened within the first hour, and half within seven. The details are what make the study uncomfortable. Labeling drives as exams or attaching a return address did not change outcomes, and neither did the drop site: a parking lot worked as well as a protected indoor space. Asked why they plugged a drive in, 68 percent of surveyed finders said they wanted to return it to its owner, and only 18 percent admitted curiosity. The researchers found no meaningful difference between people who plugged drives in and the general population. The files were harmless HTML pages with a tracking image, so every connection was counted without infecting anyone.Sharper bait: BadUSB, HID sticks and surge toys
Since 2014 the bait itself has improved. At the Black Hat conference that year, Karsten Nohl and Jakob Lell of SR Labs demonstrated BadUSB: attack code hidden in a USB device's controller firmware, where reformatting does not reach and antivirus does not look. Reflashed hardware can impersonate a keyboard and type whatever it likes the moment it is inserted. As Nohl told WIRED:"These problems can't be patched... We're exploiting the very way that USB is designed."His conclusion was that trust has to come from provenance alone: removable drives should be handled like hypodermic needles that are never shared. Scriptable HID-injection devices descended from this line of research are now sold openly as pentesting tools, which lowers the barrier for anyone who wants a stick that fires keystrokes on insertion. Not every planted drive is after data. USB killer devices draw power from the port and discharge high-voltage pulses back into the data lines, destroying the controller and often the board behind it. In 2019 a student at the College of Saint Rose in Albany pleaded guilty to destroying 66 campus computers with such a device; he was sentenced to a year in prison and ordered to pay $58,471 in restitution.
Why caution loses
The experiment's most cited lesson is that people rationalize. Most finders did not describe themselves as curious risk-takers; they described themselves as helpful. Awareness campaigns have repeated the same warning for years - CISA's guidance on removable media tells users never to insert a found drive and to hand it to IT or security staff instead - yet the 2016 results, and the worm statistics that keep rolling in, suggest warnings alone do not override the reflex.Rules that hold up
- Never plug media of unknown origin into a machine you care about. Handing a found drive to security staff or IT is the correct response, not opening it to identify the owner.
- Judge the drive, not the packaging. The study found that labels, attached keys and a tidy appearance changed nothing.
- Keep personal and work media separate, password-protect and encrypt what you carry, and keep backups.
- Disable autorun and keep security software and patches current; the older shortcut worms still depend on that path.
- If untrusted media must be examined at all, it belongs on a dedicated, offline, non-production machine - never on a daily driver - and organizations should block storage-class devices on non-essential ports by policy.