The DOI matches its Crossref record.
Users Really Do Plug in USB Drives They Find
Abstract
We investigate the anecdotal belief that end users will pick up and plug in USB flash drives they find by completing a controlled experiment in which we drop 297 flash drives on a large university campus. We find that the attack is effective with an estimated success rate of 45 -- 98% and expeditious with the first drive connected in less than six minutes. We analyze the types of drives users connected and survey those users to understand their motivation and security profile. We find that a drive's appearance does not increase attack success. Instead, users connect the drive with the altruistic intention of finding the owner. These individuals are not technically incompetent, but are rather typical community members who appear to take more recreational risks then their peers. We conclude with lessons learned and discussion on how social engineering attacks -- while less technical -- continue to be an effective attack vector that our community has yet to successfully address.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Tischer et al. (2016) found that most students did insert unattended USB drives for altruistic reasons.
“the study by Tischer et al. (2016) who placed 297 USB drives containing malware around a university campus found that for altruistic reasons, i.e. trying to find the owner, most students did insert the unattended USB drive.”
From The influence of ethical principles and policy awareness priming on university students’ judgements about ICT code of conduct compliance (2022) · cites this paper as Tischer et al. (2016)
Citations
Cites
No references could be resolved yet.
Research works printed but not linked: 52
- 10.1145/506443.506577 · DOI
- 10.1145/2335356.2335358 · DOI · Paper page
- vance, 2014, Using Measures of Risk Perception to Predict Information Security Behavior: Insights from Electroencephalography (EEG), Journal of the Association for Information Systems, 15, 10.17705/1jais.00375 · DOI
- 10.1111/j.1745-6606.2009.01148.x · DOI
- onarlioglu, 2012, Insights into User Behavior in Dealing with Internet Attacks, Network and Distributed Systems Security Symposium (NDSS)
- 10.1145/2660267.2660330 · DOI
- 10.1145/2381934.2381943 · DOI
- 10.1002/bdm.414 · DOI · Paper page
- 10.1109/PerComW.2014.6815275 · DOI
- 10.1016/j.cose.2009.05.008 · DOI
- 10.1145/2590296.2590347 · DOI
- 10.1145/2508859.2516747 · DOI
- 10.1007/978-3-642-22424-9_9 · DOI
- zetter, 2014, An unprecedented look at Stuxnet, the world's first digital weapon, Wired
- hadnagy, 2010, Social Engineering The Art of Human Hacking
- 10.1145/1290958.1290968 · DOI · Paper page
- 10.1007/978-3-642-27576-0_2 · DOI
- wright, 2012, Report The Symantec smartphone honey stick project
- 10.5817/CP2012-1-4 · DOI
- 10.1109/SPW.2014.39 · DOI
- ngo, 2011, Cybercrime victimization: An examination of individual and situational level factors, International Journal of Cyber Criminology, 5, 773
- bossler, 2009, On-line activities, guardianship, and malware infection: An examination of routine activities theory, International Journal of Cyber Criminology, 3, 400
- 2014, On-campus fall 2014 statistical abstract of ten-day enrollment, Division of Management Information
- 10.1007/BF02310555 · DOI · Paper page
- 2015, Popular names by state, Social Security Administration
- 2014, Frequently occurring surnames from the census 2000, United States Census Bureau
- 10.1136/bmj.314.7075.193 · DOI
- nunally, 1994, Psychometric Theory
- paoli, 2011, Microsoft releases security update for autorun vulnerability
- koved, 2013, Perceived security risks in mobile interaction, Symposium On Usable Privacy and Security (SOUPS)
- 10.1109/ICIET.2010.5625728 · DOI
- nohl, 2014, BadUSB-on accessories that turn evil, Black Hat USA
- 2013, Sketchup BMP Material RLE4 Heap Overflow
- larimer, 2011, USB autorun attacks against linux, Hackito Ergo Sum 2011
- sevinsky, 2013, Funderbolt: Adventures in thunderbolt DMA attacks, Black Hat USA
- hudson, 2014, THUNDER
- 2015, White paper: Cyber secure: A look at employee cybersecurity habits in the workplace, Technical Report Computer
- 10.1145/2702123.2702249 · DOI
- 2014, Turning USB peripherals into BadUSB, A laboratory for security research
- stasiukonis, 2006, Social engineering the USB way
- blais, 2006, A domain-specific risk-taking (DOSPERT) scale for adult populations, Judgment and Decision Making, 1
- mcqueen, 2010, Software and human vulnerabilities, ARC World Industry Forum 2010
- wright, 2012, Honey stick project - phase 1 results, Streetwise Security Zone Tech Rep
- 2015, Illinois facts
- wagenaar, 2011, USB baiting, Universiteit Van Amsterdam
- 10.1109/STAST.2013.15 · DOI
- gauthier, 2011, How Question Bank Was Built
- 10.2307/2529310 · DOI · Paper page
- 2015, February 2015 market share, W3Counter
- 10.1145/2556288.2557330 · DOI
- 2015, SurveyMonkey
- tevault, 1972, Regional differences in willingness to help strangers: A field experiment with a new unobtrusive measure, Social Science Research, 1, 415, 10.1016/0049-089X(72)90086-5 · DOI
Cited by
Sorted by citations
The “Human Factor” in Cybersecurity: Exploring the Accidental Insider
Hadlington, L. (2018) · Advances in Digital Crime, Forensics, and Cyber Terrorism · doi:10.4018/978-1-5225-4053-3.ch003 · Cited by 46
Richards, D., Nazeer Khan, S. B., Formosa, P., & Bankins, S. (2022) · Organizational Cybersecurity Journal: Practice, Process and People · doi:10.1108/ocj-01-2022-0001 · Cited by 2
Metadata
- Authors
- Tischer, M., Durumeric, Z., Foster, S., Duan, S., Mori, A., Bursztein, E., & Bailey, M.
- Affiliations
- University of Illinois Urbana-Champaign (US)
- Google (United States) (US)
- Venue
- 2016 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2016-05
- Pages
- 306-319
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W2508928295
- Cited by
- 98
- References
- 0
- Citations by year
- 2026: 2 · 2025: 8 · 2024: 3 · 2023: 9 · 2022: 11 · 2021: 7 · 2020: 16 · 2019: 6 · 2018: 17 · 2017: 15 · 2016: 3
- FWCI
- 11.61
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- Funders
- University of Illinois at Urbana-Champaign
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Keywords
- USB flash drives, social engineering, user security awareness, altruism, attack success rate, user motivation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
