We’ve all probably gone through at least a dozen USB drives, you may have a couple lying around the bottom of drawer somewhere, and most probably you’ve lost at least one some time or another. Have you ever thought about what you actually put in them, and if they do get lost if the person that finds it will read it? A recent study from the University of Illinois Urbana-Champaign has concluded that most people that do find lost USB drives do go though its contents.
For the experiment experiment, a team from the University dropped a total of 297 USB drives around the university campus, from toilets, hallways, parking lots and libraries, to see whether the drives would get picked up, moved, and its contents being accessed.
The files on each USB drives were made to look like any normal personal files, but they were in fact HTML files that when opened, the user’s internet browser would direct them to a page on the central server. The user would then be informed of the study and invited to answer a few questions.
Over the 297 USB drives, nearly all of them were removed, with 43% of users opening the contents but of them, 68% said they had intended to return the drive, while 18% admitted that they had only been interested in the contents.
“We hope that by bringing these details to light, we remind the security community that some of the simplest attacks remain realistic threats,” the paper’s authors write. “There is still much work needed to understand the dynamics of social engineering, develop technical defenses, and learn how to effectively teach users how to protect themselves.”
