Editing Social engineering (security) (section)

===Baiting===
Baiting is like the real-world [[Trojan horse]] that uses physical media and relies on the curiosity or greed of the victim.<ref name="Social Engineering, the USB Way">{{cite web|url=http://www.darkreading.com/document.asp?doc_id=95556&WT.svl=column1_1|title=Social Engineering, the USB Way|date=7 June 2006|publisher=Light Reading Inc|archive-url=https://web.archive.org/web/20060713134051/http://www.darkreading.com/document.asp?doc_id=95556&WT.svl=column1_1|archive-date=13 July 2006|url-status=dead|access-date=23 April 2014}}</ref> In this [[attack (computing)|attack]], attackers leave [[malware]]-infected [[floppy disk]]s, [[CD-ROM]]s, or [[USB flash drive]]s in locations people will find them (bathrooms, elevators, sidewalks, parking lots, etc.), give them legitimate and curiosity-piquing labels, and wait for victims.

Unless computer controls block infections, insertion compromises PCs "auto-running" media. Hostile devices can also be used.<ref>{{cite web |url=http://md.hudora.de/presentations/firewire/PacSec2004.pdf |title=Archived copy |access-date=2 March 2012 |url-status=dead |archive-url=https://web.archive.org/web/20071011191205/http://md.hudora.de/presentations/firewire/PacSec2004.pdf |archive-date=11 October 2007}}</ref> For instance, a "lucky winner" is sent a free [[digital audio player]] compromising any computer it is plugged to. A "'''road apple'''" (the colloquial term for horse [[manure]], suggesting the device's undesirable nature) is any [[removable media]] with malicious software left in opportunistic or conspicuous places. It may be a CD, DVD, or [[USB flash drive]], among other media. Curious people take it and plug it into a computer, infecting the host and any attached networks. Again, hackers may give them enticing labels, such as "Employee Salaries" or "Confidential".<ref>{{Cite book|title=Principles of Computer Security, Fourth Edition (Official Comptia Guide)|last1=Conklin|first1=Wm. Arthur|last2=White|first2=Greg|last3=Cothren|first3=Chuck|last4=Davis|first4=Roger|last5=Williams|first5=Dwayne|publisher=McGraw-Hill Education|year=2015|isbn=978-0071835978|location=New York|pages=193–194}}</ref>

One study published in 2016 had researchers drop 297 USB drives around the campus of the University of Illinois. The drives contained files on them that linked to webpages owned by the researchers. The researchers were able to see how many of the drives had files on them opened, but not how many were inserted into a computer without having a file opened. Of the 297 drives that were dropped, 290 (98%) of them were picked up and 135 (45%) of them "called home".<ref>{{Cite web|url=https://www.infosecurity-magazine.com/blogs/bhusa-dropped-usb-experiement/|title=#BHUSA Dropped USB Experiment Detailed|last=Raywood|first=Dan|date=4 August 2016|website=info security|access-date=28 July 2017}}</ref>