How to Execute a Viral-Worthy USB Drop Penetration Test: A Step-by-Step Guide

Introduction

Twenty years ago, a penetration tester named Steve Stasiukonis made history—and went viral—by planting rigged USB drives in a credit union parking lot and observing how employees reacted. His simple yet audacious maneuver demonstrated that even the most secure organizations can be vulnerable to human curiosity. Today, USB drop attacks remain a potent tool for testing security awareness and physical access controls. This guide breaks down the exact steps to plan, execute, and analyze a USB drop penetration test, drawing on the lessons from that legendary operation. Whether you're a seasoned pen tester or a security manager looking to run a live drill, this how-to will help you replicate the experiment safely and effectively.

What You Need

• Custom USB drives (at least 5–10) that appear ordinary—avoid flashy designs that might raise suspicion.
• Payload software (e.g., Rubber Ducky scripts or a simple autorun file) that simulates a malicious action without causing real harm (e.g., opening a benign pop-up, logging keystrokes in a sandbox, or copying a dummy file).
• Encryption and data-wiping tools to secure any collected information and sanitize drives after the test.
• Observation equipment like discreet cameras or note-taking apps to record employee behavior (with prior legal approval).
• Legal and policy clearance in writing from your organization or client, including explicit permission from the legal department and HR.
• Communication protocol—a plan for alerting employees after the test without causing panic (e.g., a general security awareness email).
• Deployment map of target areas (parking lots, break rooms, lobbies) where drives are likely to be discovered.

Step-by-Step Instructions

Step 1: Obtain Formal Authorization

Before you even touch a USB drive, secure written consent from the organization's management and legal team. Outline the scope—what actions the USB will perform, how long the test runs, and which employees or locations are off-limits. Without this step, you risk legal consequences and upsetting staff. Steve Stasiukonis worked under a pre-approved contract with the credit union; you should too.

Step 2: Design Your Payload

Craft a realistic but harmless payload that mimics a real malware behavior. For example, have the USB automatically open a file that logs a timestamp and the computer's hostname (like a dropper) but never exfiltrates data or damages the system. Use scripting languages like PowerShell or Python to keep it simple. Test the payload on a non‑production machine to ensure it works as intended and triggers an alert you can track.

Step 3: Prepare the USB Drives

Load the payload onto each USB drive. Format the drives to look like ordinary storage—maybe add a few dummy files like “Employee Bonuses.pdf” or “HR Payroll Data.xlsx” to entice clicks. Label the drives randomly (e.g., “Meeting Notes” or “Project Backup”) to avoid suspicion. Use identical, unbranded drives to maintain uniformity. In the original test, Stasiukonis used generic USB sticks that blended in with typical office accessories.

Step 4: Choose Deployment Locations and Timing

Identify high-traffic areas where employees are likely to notice a stray USB drive—parking lots, entrance doors, cafeteria tables, or near office cubicles. Timing matters: deploy early in the morning or during lunch break when people are moving around. Avoid placing drives in obvious spots like directly on a manager’s desk; instead, drop them near trash cans, planters, or on the ground. The credit union test focused on the parking lot because employees often walk through it without thinking about security.

Step 5: Deploy the Drives Discreetly

Carry the USB drives in a pocket or small bag. Casually “drop” them in your chosen locations—bend down to tie a shoe, set down a coffee cup, and let the drive slip out. Do not make eye contact or linger. For the parking lot, you can pretend to look for something in your car while placing a drive on the pavement or near a curb. The key is to appear natural and avoid drawing attention to yourself.

Step 6: Monitor and Record Employee Reactions

Set up covert surveillance (with prior approval) using tiny cameras or by stationing an observer in a nearby vehicle or break room. Note which employees pick up a drive, how they examine it, and whether they plug it into a computer immediately, later, or not at all. In the original story, Stasiukonis watched from a distance and recorded how many employees inserted the drive within the first few hours. Keep a log of timestamps and behaviors.

Step 7: Trigger Payload and Collect Data

When an employee inserts the USB, your payload activates. If you designed it to send a DNS query or create a hidden file on the host, have a server capture that event. For simplicity, you can program the drive to open a webpage that logs the user’s IP address and time. Never collect personal information like passwords or private documents—stick to metadata only. Once the payload fires, your test is recorded.

Step 8: End the Test and Recover Drives

After a predetermined period (e.g., 48 hours or one workweek), announce the end of the exercise via email or a company-wide meeting. Request that any found drives be returned to IT. Physically retrieve the drives you planted, ensuring none are left in the wild. Stasiukonis collected his drives after two days to avoid any long-term risk.

Step 9: Analyze Results and Report

Compile your observations into a report: how many drives were picked up, how many were inserted, how quickly, and any patterns you noticed (e.g., employees in finance were more cautious than those in sales). Include a timeline and compare against industry benchmarks. The data from the original test—75% of drives were plugged in within an hour—stunned the credit union and later became a viral case study.

Step 10: Deliver Security Awareness Training

Use the results to reinforce good practices. Prepare a short, non‑punitive training session that explains why USB drops are dangerous and how to report suspicious devices. Emphasize that employees should never plug unknown USB drives into any computer. Share the story of the original test to illustrate how easily even a secure facility can be compromised. Follow up with periodic reminders and possibly a second test down the line.

Tips for Success

• Get buy-in from leadership early. Without executive support, the exercise could backfire and create distrust.
• Never use a real malware payload. Keep the test completely safe—no data theft, no system damage.
• Label the drives with a contact number (e.g., “If found, please return to IT”) so employees know where to turn them in, but only after the test has concluded to avoid ruining the surprise.
• Consider a parallel social engineering test (like sending a phishing email) for a comprehensive security evaluation.
• Document everything—the number of drives deployed, pick-up rates, insertion rates, and any employee comments—to build a compelling case for additional security measures.
• Make the post-test training engaging. Use the actual numbers from your test; they are far more convincing than generic statistics.
• Plan for a “warm” debrief with employees who plugged in the drives. Let them know they are not being punished; instead, they have helped identify a critical vulnerability.