USB Drop Attack: Why 48% of People Plug In Found Drives

Nearly half of people who find a random USB stick will plug it straight into their computer. Here is why that simple act could hand an attacker the keys to your whole network.

Imagine you find a USB stick in your office parking lot. No label, no owner, just a small drive sitting on the ground. Would you plug it in to see what is on it? If you said yes, you are not alone, and that is exactly the problem. A USB drop attack relies on this very instinct, and the data shows it works far better than it should.

A USB drop attack is when an attacker deliberately leaves infected USB drives in public places, hoping someone curious will pick one up and connect it. The moment that drive is plugged in, malicious software can run, steal data, or open a hidden door into your network. It sounds like a movie plot, but researchers proved it is real.

The Experiment That Proved USB Drop Attacks Work

Security researchers wanted to know if this attack was a genuine threat or just a story pentesters tell at conferences. So they ran a real test. They scattered nearly 300 USB drives across a university campus and waited to see what people would do.

The results were eye-opening. A full 48% of the drives were not only picked up and plugged in, but had at least one file opened. The very first drive was connected in less than six minutes. People were not cautious. They were curious, and they acted fast.

48% of dropped USB drives were plugged in and had files opened. The first one was connected in under six minutes.

Here is the scary part for defenders: the timeline is brutal. About 20% of the drives were connected within the first hour, and half within seven hours. That leaves almost no time to detect the attack before damage is done. Even when warnings about strange USB sticks appeared online a day later, people kept plugging them in anyway.

Why Location Does Not Save You

You might assume a drive dropped in a busy parking lot is more likely to be ignored than one left in a secure office. The study found the opposite was true. The open rate was about the same no matter where the drive was left.

This means an attacker does not need to break into your building. They do not need a badge, a disguise, or a clever excuse. They just need to drop a few cheap drives near where people walk. That low cost and high success rate is what makes this attack so dangerous for small businesses.

Everyone Is Vulnerable, Even Tech-Savvy People

You would expect people who know about cybersecurity to resist the temptation. The data says otherwise. The researchers found no meaningful difference between the people who plugged in drives and the general population.

Security knowledge, education level, and background did not reliably predict who would take the bait. This is an uncomfortable finding. It suggests that simply telling people “do not plug in strange USB drives” may not be enough on its own. Curiosity is a powerful force, and attackers know how to use it.

Why People Plug In Drives They Find

Most people are not careless. They are helpful and curious. Some plug in a drive hoping to find the owner and return it. Others just want to see what is on it. Attackers exploit these good intentions by labeling drives with tempting names like “Payroll” or “Confidential.”

How to Protect Yourself From USB Drop Attacks

The good news is that defending against a USB drop attack does not require expensive tools. It comes down to one simple rule and a few practical habits. Here is what you can do today.

1. Never Plug In a USB Drive You Did Not Buy

This is the single most important habit. Treat any found USB drive like a stranger handing you an unmarked pill. You have no idea what is inside, so do not put it in your computer. If you find one at work, hand it to your IT team or security contact without plugging it in.

2. Train Your Family and Coworkers

Since security knowledge alone is not a perfect shield, regular reminders matter. Talk to your relatives, friends, and colleagues about this specific risk. Make “found USB drives go to IT, never into a laptop” a clear and repeated rule. Sharing this article is an easy first step.

3. Disable or Restrict USB Ports

For businesses, you can block the use of USB storage devices entirely. On Windows, an administrator can restrict access to the storage driver so unknown drives simply will not mount. With cloud storage and fast internet now standard, most teams rarely need physical USB sticks anyway.

4. Use Device Control Tools

More advanced tools can block unknown USB devices the moment they connect, or allow only approved device types like a keyboard or mouse. These controls add a strong layer of protection by removing the human decision entirely. If a strange drive cannot mount, curiosity cannot cause harm.

Strong USB habits work best alongside other basics. A clear set of rules, like the ones in our guide on why your business needs a password policy, gives your team a foundation to build on. And since attackers often combine tricks, knowing how to spot smarter phishing emails rounds out your defenses.

The Bottom Line

The USB drop attack is not a myth. It is a cheap, fast, and reliable way for attackers to get inside a network, and nearly half of people fall for it. The fix is refreshingly simple: never plug in a drive you did not buy yourself. Build that habit, share it, and you remove one of the easiest paths an attacker has.