A new study found that almost half of people who find a USB stick in a parking lot will plug it into their computers.
Researchers from Google, the University of Illinois, and the University of Michigan threw 297 USB drives around the campus of the University of Illinois at Urbana-Champaign, and found that 48 percent of the USB drives were plugged into a computer within minutes.
“The security community has long believed that users can fall victim to social engineering attacks by picking up and connecting seemingly “lost” USB flash drives,” the researchers report.
“Unfortunately, whether out of altruistic motives or human curiosity, the user unknowingly opens a door to an attack when they plug in the drive. A natural Trojan horse.”
For the study, the researchers used USB sticks that contained HTML files with img tags embedded in them. When the files were opened, the image communicated with a remote server, allowing the researchers to monitor the use of the USB drives in the area.
USB sticks took from a few minutes to a few hours to connect to computers.
Additionally, the study found that only 16% of users bothered to scan the drives with an anti-virus before opening them on their computers. 68% of respondents said they took no precautions whatsoever before connecting the drives.
Users said they mostly acted in good faith. 68% of users said they opened the removable drive to find its owner, and very few respondents said they planned to keep the USB.
