UIUC USB Drive Drop Field Experiment (2015)

What happened

Between April 27-29, 2015, a research team from the University of Illinois Urbana-Champaign (UIUC), University of Michigan, and Google dropped 297 USB flash drives at 30 locations across the UIUC campus to empirically test the long-anecdotal claim that people will plug in USB drives they find. The drives contained inert HTML "beacon" files disguised as resumes, photos, exam files, or confidential documents; opening any file in a browser silently notified the researchers' server with script-free HTML and no automatically run code. The study found that 290 of 297 drives (98%) were picked up/removed from their drop sites and 135 of 297 (45%) were connected and had a file opened, yielding the paper's headline "estimated success rate of 45-98%." The first connection happened in under six minutes; the median time to first connection was 6.9 hours. A follow-up survey of finders found the dominant motive was altruism (68% said they wanted to find and return the drive's owner), not curiosity (18%) or self-interest. The peer-reviewed paper, "Users Really Do Plug in USB Drives They Find," was presented at the 2016 IEEE Symposium on Security and Privacy.

How it worked

Researchers purchased ~300 generic USB flash drives and prepared five "content" conditions to test whether appearance/labeling affected pickup: (1) unlabeled/generic drives, (2) drives labeled "exams," (3) drives labeled "confidential," (4) drives with physical keys attached, and (5) drives with a printed return-address label. Each drive's file system was seeded with content matching its label (private photos/files for unlabeled or keyed drives, business documents for "confidential," coursework for "exam" drives). Every seeded file was actually an HTML file containing an embedded <img> tag pointing to a researcher-controlled server; opening any file in a browser silently "phoned home," logging a connection using script-free HTML and without automatically running code. Between April 27 and 29, 2015 (143 drives on day 1, 145 on day 2, 9 on day 3), the team scattered all 297 drives across 30 distinct locations spanning three sub-areas of the UIUC campus (Main Quad, South Quad, Engineering Quad), covering five location types: parking lots, hallways, academic spaces (classrooms/libraries), common areas (lobbies/cafeterias), and outdoor walkways. Anyone who opened a phoned-home file was shown a message inviting them to complete a voluntary survey (for $10 compensation) about why they picked up and connected the drive, and offering an opt-out.

The lure and the tell

The "lure" was situational rather than a crafted pretext: a seemingly lost, ordinary USB drive lying on the ground in a plausible spot (parking lot, hallway, classroom). No labeling scheme increased success over the plain unlabeled drive; the paper explicitly found that a drive's appearance did not raise the odds it was connected. The dominant "tell" a security-aware target should have caught: any unknown storage device found in public should never be connected to a personal or work computer, regardless of how innocuous or how urgent the apparent need to identify its owner feels. The safe action is to hand it to IT/security/lost-and-found, not open it yourself.

Outcome

This academic study used HTML files containing an embedded image hosted on a centrally controlled server to detect when a file was opened. The findings: 290 of 297 drives (98%) were removed from their drop locations; 135 of 297 (45%) had at least one file opened, triggering the phone-home beacon; the paper reports this as a bounded estimated success rate of 45-98% depending on whether "success" is defined as pickup or as file-open. Median time to first connection was 6.9 hours; the very first connection occurred in under six minutes. Of the ~20% of finders (62 people) who completed the voluntary survey, 68% said they connected the drive to try to find and return it to its owner (altruism), 18% cited curiosity, 8% listed the location in their answer, and roughly 3% said they intended to keep the drive. The researchers concluded that none of the tested drive types increased success, while return-address labels reduced it, and that finders were not less technically savvy than peers but instead simply took more recreational risks. The paper was published as "Users Really Do Plug in USB Drives They Find" at the 2016 IEEE Symposium on Security and Privacy (DOI 10.1109/SP.2016.26).

Why it matters

This is the most frequently cited empirical, peer-reviewed evidence that USB-drop baiting, long treated as pentester folklore or a Mr. Robot plot device, is a genuinely effective real-world initial-access technique, with a measured success rate (45-98% depending on definition) and a median exploitation window under seven hours. It reframes the human-factors risk: the study found none of the tested drive types increased success, while return-address labels reduced it, and that the people who fell for it were not less tech-savvy than their peers but were driven by an altruistic instinct to return a lost item, meaning defenses built around "don't be curious" or "don't be careless" miss the actual psychological trigger. It is widely cited by security-awareness programs, red teams, and physical-security policy writers as the quantified baseline for why USB-drop/baiting remains part of criminal and red-team tradecraft (e.g., FIN7's mailed BadUSB campaigns).

Defenses

Paper's own recommendations: user education on the specific risk of plugging in found/unknown USB media (generic "don't plug in random drives" warnings proved insufficient since altruistic finders bypassed them); disabling AutoRun/AutoPlay; endpoint controls that block or sandbox unknown removable media (device control / USB port management, application allow-listing); physical-security policies for organizations (e.g., banning personal USB use, providing a clear "found item" reporting procedure so altruistic finders have a safe alternative to plugging the drive in themselves); security-awareness training that specifically addresses the "return the drive to its owner" instinct exploited by real attackers, since the study found appearance/labeling of the drive did not change success rate and that curiosity was not the dominant driver.