The Hidden Dangers of Unknown USB Drives

Think Before You Plug

Have you received a mysterious USB stick in the mail or found one lying around campus? You’re not alone—and you should not plug it in.

Recently, members of the UBC community have reported receiving unsolicited packages containing USB thumb drives. Thankfully, these incidents were reported to UBC Cybersecurity; however, they serve as a critical reminder: unknown USB devices can pose serious risks to your data and device.

Why Plugging in Unknown USBs is Dangerous

• Malware Infections: USB drives can be preloaded with malicious software that installs automatically when inserted. This includes ransomware, spyware, or keyloggers designed to steal sensitive data or disrupt university systems.

• Silent Data Theft: Some USB sticks are programmed to silently extract data from your machine without any visible prompt or permission request.
• USB Killer Devices: Even more alarming is so-called “USB killer” devices. These are specially modified USBs that can deliver a high-voltage electric charge—physically frying your computer’s internal components.
• Social Engineering Tactics: Attackers often rely on curiosity or goodwill. A USB stick left in a public place or sent anonymously might be part of a ploy to trick someone into unknowingly compromising a secure system.

If You’ve Already Plugged It In

Accidents happen. If you’ve already inserted an unknown USB device, whether for a moment or longer, it’s important to act quickly.

• Stop using the computer immediately to prevent any potential malware from spreading or further damaging the system.

• Report the incident to UBC Cybersecurity right away at security@ubc.ca.
• If the USB device arrived by mail or courier, do not discard the packaging—it may contain valuable information for the Cybersecurity team.
• Change your CWL passphrase immediately, especially if you logged in while the USB was connected.

What You Can Do to Stay Safe

• Do not plug in USB drives from unknown or untrusted sources—even if they appear to be brand new or sealed.
• Report any unexpected USB packages or suspicious devices to your local IT support or the UBC Cybersecurity team immediately.
• Use university-approved endpoint protection software that can detect and scan external devices before allowing access.
• Educate your team and peers about the risks associated with unknown USB devices, particularly when working with sensitive data.

UBC is committed to maintaining a secure digital environment for everyone. If you ever encounter a suspicious device or aren’t sure whether it’s safe to use, report it to security@ubc.ca.

Go Further...

• Share Files Securely
• Protect My Devices