USB drop attack

A USB drop attack leaves a malicious device where a target will find it, expecting curiosity or helpfulness to complete the intrusion. The victim performs the compromise themselves, which is why it defeats network perimeter controls entirely, including air gaps.

This library records 4 cases, spanning 2008 to the present, including one controlled experiment that quantified the hit rate.

How the attack runs

1. Choose a location where the finder is likely to be an employee: car park, reception, canteen.
2. Make it appealing or plausible, sometimes labelled to suggest it matters.
3. Rely on the finder connecting it, often intending to identify the owner.
4. Execute on connection, whether by autorun, a disguised file, or firmware that presents the device as a keyboard.
5. Cross the boundary that network controls were protecting.

Documented cases

• Operation Buckshot Yankee (2008, about $155M): an infected drive breached US Central Command networks and triggered a fourteen-month cleanup.
• Stuxnet (2010): infected drives carried in by trusted contractors crossed the air gap into Iran’s Natanz enrichment facility.
• FIN7 (2020): weaponised drives posted to targets by USPS, packaged with a gift card to increase the chance of use.
• A University of Illinois field experiment (2015) dropped drives on campus and measured how many were picked up and connected. It is the cleanest available evidence that the technique works on ordinary, well-intentioned people.

How it differs from related techniques

Physical social engineering is the parent category, covering tailgating and baiting. Unlike phishing there is no message to inspect, and unlike supply-chain compromise the delivery is a physical object rather than a trusted relationship.

The control that would have stopped it

• Device control policy that blocks unknown removable media by default.
• Provide a safe disposal route. Staff need somewhere to hand a found drive, or curiosity wins. The UIUC experiment shows the motive is usually helpfulness, not carelessness.
• Extend the policy to contractors, who carried the Natanz infection in.
• Treat unsolicited hardware in post as suspicious, which is the specific FIN7 lesson.
• Assume the air gap is crossable and monitor inside it accordingly.