Tech teamRunning a website or small org
USB drop attacks
A “lost” memory stick, left for a curious person to plug in.
Understand it
Attackers leave infected USB sticks in car parks and receptions, trusting to curiosity. Plugging one in can install malware at once - some even pose as a keyboard and type their own commands.
How to spot it
Unlabelled or “found” USB sticks, or ones handed out by strangers at events.
Close the gap
- Never plug in a USB device you did not buy, or cannot vouch for.
- Hand a found device to IT; do not check whose it is yourself.
- Disable auto-run on every machine.
- Use USB controls on sensitive systems.
What to do about it
This sits with whoever builds and runs your website or systems - it’s beyond what a personal plan should promise to fix. If that’s not you, hand it to whoever looks after your security. We’d rather be honest about where we stop.
Your own accounts and devices are still worth protecting; your plan covers those.