Researchers from UIUC, the University of Michigan, and Google dropped 297 USB drives across the UIUC campus and found that up to 98% were picked up and 45% were plugged in and opened, with the first connection occurring in under six minutes, the first rigorous, quantified real-world proof that USB-baiting works.
Reviewed by the Social Engineering Examples team.
Between April 27-29, 2015, a research team from the University of Illinois Urbana-Champaign (UIUC), University of Michigan, and Google dropped 297 USB flash drives at 30 locations across the UIUC campus to empirically test the long-anecdotal claim that people will plug in USB drives they find. The drives contained inert HTML "beacon" files disguised as resumes, photos, exam files, or confidential documents; opening any file in a browser silently notified the researchers' server without executing code. The study found that 290 of 297 drives (98%) were picked up/removed from their drop sites and 135 of 297 (45%) were connected and had a file opened, yielding the paper's headline "estimated success rate of 45-98%." The first connection happened in under six minutes; the median time to first connection was 6.9 hours. A follow-up survey of finders found the dominant motive was altruism (68% said they wanted to find and return the drive's owner), not curiosity (18%) or self-interest. The peer-reviewed paper, "Users Really Do Plug in USB Drives They Find," was presented at the 2016 IEEE Symposium on Security and Privacy, and co-author Elie Bursztein presented the results again at Black Hat USA 2016.
Researchers purchased ~300 generic USB flash drives and prepared five "content" conditions to test whether appearance/labeling affected pickup: (1) unlabeled/generic drives, (2) drives labeled "exams," (3) drives labeled "confidential," (4) drives with a physical keyring attached, and (5) drives with a keyring plus a printed return-address label. Each drive's file system was seeded with content matching its label (private photos/files for unlabeled or keyed drives, business documents for "confidential," coursework for "exam" drives). Every seeded file was actually an HTML file containing an embedded tag pointing to a researcher-controlled server; opening any file in a browser silently "phoned home," logging a connection without executing any code or altering the victim's machine. Between April 27 and 29, 2015 (143 drives on day 1, 145 on day 2, 9 on day 3), the team scattered all 297 drives across 30 distinct locations spanning three sub-areas of the UIUC campus (Main Quad, South Quad, Engineering Quad), covering five location types: parking lots, hallways, academic spaces (classrooms/libraries), common areas (lobbies/cafeterias), and outdoor walkways. Anyone who opened a phoned-home file was shown a message inviting them to complete a voluntary survey (in exchange for a gift card) about why they picked up and connected the drive, and offering an opt-out.
The "lure" was situational rather than a crafted pretext: a seemingly lost, ordinary USB drive lying on the ground in a plausible spot (parking lot, hallway, classroom). No labeling scheme increased success over the plain unlabeled drive; the paper explicitly found that a drive's appearance did not raise the odds it was connected. The dominant "tell" a security-aware target should have caught: any unknown storage device found in public should never be connected to a personal or work computer, regardless of how innocuous or how urgent the apparent need to identify its owner feels. The safe action is to hand it to IT/security/lost-and-found, not open it yourself.
No harm occurred. This was an IRB-governed academic study using inert HTML "beacon" files that only logged a connection event, never executing code or accessing victim data. The findings: 290 of 297 drives (98%) were removed from their drop locations; 135 of 297 (45%) had at least one file opened, triggering the phone-home beacon; the paper reports this as a bounded estimated success rate of 45-98% depending on whether "success" is defined as pickup or as file-open. Median time to first connection was 6.9 hours; the very first connection occurred in under six minutes. Of the ~20% of finders (62 people) who completed the voluntary survey, 68% said they connected the drive to try to find and return it to its owner (altruism), 18% cited curiosity, 8% said the drop location drew their attention, and roughly 3% said they intended to keep the drive. The researchers concluded that appearance/labeling of the drive did not meaningfully change success, and that finders were not less technically savvy than peers but instead simply took more recreational risks. The paper was published as "Users Really Do Plug in USB Drives They Find" at the 2016 IEEE Symposium on Security and Privacy (DOI 10.1109/SP.2016.26), and co-author Elie Bursztein (Google) later presented the results at Black Hat USA 2016 ("Does Dropping USB Drives in Parking Lots and Other Places Really Work?", Aug 3, 2016).
This is the most frequently cited empirical, peer-reviewed evidence that USB-drop baiting, long treated as pentester folklore or a Mr. Robot plot device, is a genuinely effective real-world initial-access technique, with a measured success rate (45-98% depending on definition) and a median exploitation window under seven hours. It reframes the human-factors risk: the study found the drive's appearance/labeling did not matter, and that the people who fell for it were not less tech-savvy than their peers but were driven by an altruistic instinct to return a lost item, meaning defenses built around "don't be curious" or "don't be careless" miss the actual psychological trigger. It is widely cited by security-awareness programs, red teams, and physical-security policy writers as the quantified baseline for why USB-drop/baiting remains part of criminal and red-team tradecraft (e.g., FIN7's mailed BadUSB campaigns).
Paper's own recommendations: user education on the specific risk of plugging in found/unknown USB media (generic "don't plug in random drives" warnings proved insufficient since altruistic finders bypassed them); disabling AutoRun/AutoPlay; endpoint controls that block or sandbox unknown removable media (device control / USB port management, application allow-listing); physical-security policies for organizations (e.g., banning personal USB use, providing a clear "found item" reporting procedure so altruistic finders have a safe alternative to plugging the drive in themselves); security-awareness training that specifically addresses the "return the drive to its owner" instinct exploited by real attackers, since the study found appearance/labeling of the drive did not change success rate and that curiosity was not the dominant driver.
DOJ unsealed indictments and won guilty pleas, prison terms, and multimillion-dollar restitution against FIN7 (Carbanak Group) members Fedir Hladyr, Andrii…
A Pennsylvania shredding-business owner's 2010 qui tam suit alleged that Shred-It, Iron Mountain, and Cintas billed federal agencies for GSA-spec…
A Metropolitan Police officer spotted customers' passports and tax-credit paperwork clearly visible through transparent bin bags left on the street…
Social Engineering Examples