The Honey Stick Project

While leaving the gym one day, tired and hungry, you look down and see a large, slice of all-dressed pizza sitting on the freshly cleaned hallway floor. Nobody’s around. Do you pick it up and eat it? … Why not? Germs, you say? But the floor looks so clean. Surely it can’t have that many germs on it, and you are VERY hungry… still no?

OK, so you are normal and sane.

Now imagine that same hallway, and nobody else is around, but you find a USB memory stick lying there. What do you do?

Perhaps you pick it up, thinking somebody must have lost it. You take it to the front desk. They say, “I don’t want it… and I just started working here. They didn’t tell me where the lost and found is.”

So you are stuck with it. What do you do with it? You could:

a) Take it home and plug it in to see what’s on it, to see whose it might be;
b) Put it back where you found it, hoping they come back looking for it;
c) Something else?

I’m going to suggest that putting it in a computer, for any purpose, is roughly equivalent to picking up the piece of pizza you also found on the floor and putting it into your mouth. Now you hear your mother’s voice saying, “Don’t you dare put that thing in your mouth. You don’t know where it’s been…”

It seems that the problem lies in the fact that not many of us had a parental figure drilling into our heads that inserting things we find into whatever slot will accept them in our computer is a bad thing. There can be Germs that can make your computer very sick.

What are the chances? At the moment, maybe the chances aren’t very high that a device you find is “contaminated“. However, I think most security professionals would agree that the risk will be rising constantly, as hackers and social engineers realize that abandoned Mobile Storage Devices, such as USB Memory Drives, are an easy way to trick people into infecting their computers with viruses, spyware or other malicious software. This can easily enable them to take control of your computer and turn it into a Zombie, to be used for spamming or attacks on other computers or networks.

While leaving the gym one day, tired and hungry, you look down and see a large, slice of all-dressed pizza sitting on the freshly cleaned hallway floor. Nobody’s around. Do you pick it up and eat it? … Why not? Germs, you say? But the floor looks so clean. Surely it can’t have that many germs on it, and you are VERY hungry… still no?

OK, so you are normal and sane.

Now imagine that same hallway, and nobody else is around, but you find a USB memory stick lying there. What do you do?

Perhaps you pick it up, thinking somebody must have lost it. You take it to the front desk. They say, “I don’t want it… and I just started working here. They didn’t tell me where the lost and found is.”

So you are stuck with it. What do you do with it? You could:

a) Take it home and plug it in to see what’s on it, to see whose it might be;
b) Put it back where you found it, hoping they come back looking for it;
c) Something else?

I’m going to suggest that putting it in a computer, for any purpose, is roughly equivalent to picking up the piece of pizza you also found on the floor and putting it into your mouth. Now you hear your mother’s voice saying, “Don’t you dare put that thing in your mouth. You don’t know where it’s been…”

It seems that the problem lies in the fact that not many of us had a parental figure drilling into our heads that inserting things we find into whatever slot will accept them in our computer is a bad thing. There can be Germs that can make your computer very sick.

What are the chances? At the moment, maybe the chances aren’t very high that a device you find is “contaminated“. However, I think most security professionals would agree that the risk will be rising constantly, as hackers and social engineers realize that abandoned Mobile Storage Devices, such as USB Memory Drives, are an easy way to trick people into infecting their computers with viruses, spyware or other malicious software. This can easily enable them to take control of your computer and turn it into a Zombie, to be used for spamming or attacks on other computers or networks.