Every security awareness deck has the parking-lot USB slide, and everyone in the room nods, and the plug-in rate in controlled drops still runs embarrassingly high. Researchers who have scattered drives on campuses report that roughly half get connected, and curiosity does the rest. But treating this as a USB problem misses the pattern. The attack is not the stick. The attack is the innocent-looking thing you did not order, arriving with perfect timing.
The gift is the payload. The wrapping changes every season.
Recent wrapping
- The mailed package: a documented criminal campaign shipped malicious USB drives to companies in parcels dressed up as health advisories and gift boxes, teddy bear included, so reception would carry the device straight past the perimeter.
- The free service: offers of complimentary snow removal, landscaping or pressure washing put a vehicle, a crew and a quiet laptop inside your fence for hours, well inside wireless range of networks that were never meant to be reachable from the yard.
- The shipped implant: security researchers demonstrated "war-shipping": a phone-sized board with a modem hidden in a parcel that waits in your mailroom, sniffing for wireless credentials from inside the building.
- The aquarium: a casino was famously reached through a connected fish-tank thermometer in the lobby, an object nobody classified as attack surface because it was decor.
What the pattern teaches
Each of these succeeded because the object arrived under a category that switched scrutiny off: mail, vendor, amenity. The defense is not another awareness slide; it is removing the category exemption. Anything that crosses the line gets the same questions, whether it is a person, a parcel or a plow.
- Ports are policy: USB storage blocked by configuration, not by trust, with an amnesty box at reception for found media.
- Mailroom discipline: unexpected devices are incidents, not curiosities, and parcels for critical areas get opened away from them.
- Wireless hygiene: guest and corporate networks separated for real, wireless intrusion detection on the halls, and a periodic walk of the parking lot with the same tools a free-service crew would carry.
- No free lunches: any unsolicited service touching the site goes through vendor vetting, however friendly the quote. Especially then.
We test what sites accept for free, always with permission. The findings change habits gently, and for good.