USB and Removable Media Safety
That USB stick you found in the parking lot is one of the oldest tricks in the book. Attackers deliberately drop infected drives, or leave tempting labels like "Salaries" or "Confidential", knowing curiosity will do the rest. This is called baiting.
The risks of removable media
A single USB drive can cause real damage:
- Auto-running malware that infects your computer the moment it connects.
- Drives that imitate a keyboard to type malicious commands automatically.
- Data theft or ransomware spreading from the drive to your network.
- Lost or stolen drives leaking whatever sensitive files they held.
Safe habits
Keep removable media low-risk:
- Never plug in a USB drive you found or received unexpectedly, hand it to IT/security.
- Only use drives you own and trust.
- Encrypt any drive that holds sensitive data, in case it is lost.
- Follow your workplace policy, many organizations restrict USB ports for good reason.
- Prefer trusted cloud sharing over passing drives around.
How it plays out in the real world
Based on real, widely reported incident patterns; names and details are illustrative.
The flash drive labeled "Layoffs Q3"
During a security exercise, testers scattered flash drives in a company's parking lot and lobby. Several were labeled things like "Layoffs Q3" and "Executive Salaries". Nearly half were plugged into work computers within two days. Curiosity did the attackers' work for them.
Real attackers use the same trick, and the payload does not need a file to be opened: some malicious drives act as keyboards the moment they connect, typing commands faster than anyone can react.
- The label is the exploit. "Salaries", "Layoffs", "Confidential": the more irresistible the name, the more deliberate the trap.
- Plugging in is already the compromise. USB devices can impersonate keyboards and act instantly. There is no safe peek at an unknown drive.
- Found media goes to IT, full stop. Hand it over to be examined on an isolated machine. For moving files, use approved cloud shares instead.
Test yourself
Test your removable-media awareness, free.
Frequently asked questions
Is it really dangerous to plug in a found USB drive?
Yes. Attackers deliberately leave infected drives hoping someone plugs one in. Some drives infect a computer automatically, or act like a keyboard to run commands. Never plug in a drive you did not buy yourself.
What should I do if I find a USB drive at work?
Do not plug it into any computer. Hand it to your IT or security team, they can inspect it safely. Plugging it in "just to see who it belongs to" is exactly the trap.
Are USB drives outdated now that we use the cloud?
They are used less, but still common, and still risky. Where possible, share files through trusted cloud services, which avoids the loss, theft, and malware risks of physical drives.