Ask HN: Saw a USB stick didn't pick it up | Hacker News Reader

Ask HN: Saw a USB stick didn't pick it up

6 pointslarrys9 comments

Before picking up breakfast this morning I saw a USB stick (which was opened up as if to attract more attention) on the ground in front of me as I walked. I left it there but by the time I retraced my steps someone had already picked it up.

I am curious what others would do if they found a USB stick.

Would they pick it up and dispose of it (so nobody else could be harmed) or would save it and be tempted to read or analyze it it a way that wouldn't make them susceptible to firmware exploits and so on?

View on HN

I'd pick it up and post a 'found a USB' stick on a lamppost near where I found it. Then if nobody claimed it after a few weeks I'd destroy it.

I'd never attempt to read it, for one that would be a gross violation of the privacy of whoever owned the stick in the first place, second it might be placed there on purpose.

But if someone simply lost it the right thing would be for them to have it back.

Re: the "gross violation of privacy" didn't even think about that at all.

My thoughts:

I would argue though that (subject to "infection" risk) it is no different than looking in a wallet to find the owner or looking into a laptop bag.

Entirely possible that the USB contains identifying information that can help locate the owner.

Wallets contain money, driving licenses and credit cards and such. USB drives may contain peoples lives, incriminating information, pictures that you wished you had not seen, state secrets and so on. Once you read that data you move yourself into a position of some responsibility and then your question is a harder one than the one that you asked above.

That's why I'd destroy the stick if not properly claimed.

"...incriminating information, pictures that you wished you had not seen ..."

Since the device might contain photos that are illegal to merely possess, I'd be worried about even carrying it in my pocket or keeping it in my home. I'd just leave it where it was, hoping the owner would come back for it.

"<...> peoples lives, incriminating information, pictures that you wished you had not seen, state secrets and so on <...>" if anyone puts any of this on USB sticks and carry them around daily, I must say they are not very smart.

I reminds me USB dead drop.

https://en.wikipedia.org/wiki/USB_dead_drop

A digital bottle thrown in the sea.

Honestly I'd just plug it in and look through the files. Meh, seems quite unlikely it'll break the computer or infect it (I wouldn't expect Linux to be a big target for something left lying around anyway).

Besides, you can probably find the owner from the files on the USB stick and return it. If I can't find the owner this way I'd probably hand it in somewhere near.

You don't describe the physical environment where the stick was dropped, but if it were an area like a college campus or office complex, I would assume that it was an attempt to infect someone's computer with a trojan/keylogger. I'd drop the device into a nearby rubbish bin.

I'd take it home and analyse it. The curiosity would be too much to refuse. Besides, it might have clues on how to contact the owner. Or documents that would be interesting to read.

Reply on news.ycombinator.com