USB Drop Attacks

Layer 1: Physical Medium risk

How it works

In a USB drop attack, someone leaves storage devices in a parking lot, lobby, washroom or shared space, sometimes labelled with tempting titles such as payroll or confidential. Some are mailed to businesses disguised as promotional gifts. The attacker is counting on a helpful or curious person to plug the device in to see what is on it or find its owner. The tactic has a long track record, and it continues to work because it appeals to ordinary curiosity and helpfulness.

A drive may contain files that install malware when opened, or the device may only look like a storage stick while actually acting as a keyboard that types commands the moment it is connected. Because this bypasses email and web filtering, it can be effective against organizations that have otherwise good protection, especially where users have administrator rights. Mailed devices can look like legitimate marketing items, which lowers people's guard.

Warning signs

• Unclaimed USB drives found on site
• Unexpected packages containing USB devices or gifts
• A device that opens windows or types on its own
• Security alerts after connecting removable media
• Drives labelled to provoke curiosity

How to defend against it

• Restrict or block unknown USB storage through device policies
• Disable autorun on all computers
• Remove local administrator rights from users
• Train staff to hand found devices to IT unopened
• Use endpoint protection that scans removable media

If it happens to you

1. Unplug the device and do not connect it elsewhere
2. Disconnect the computer from the network and call IT
3. Hand the device to IT for safe analysis
4. Scan or rebuild the affected computer