A classmate plugged a suspicious USB device into my PC without my consent. Should I be worried?

[u/ball-and-ball]

I was at university when one of my classmates told me he wanted to experiment with something. He had a strange-looking device attached to a USB cable and wanted to plug it into my computer.

I refused because I didn't know what the device was or what it could do.

However, while I was distracted, he plugged it into my PC without my permission.

When he did, I noticed that an Instagram page opened in the browser, and he followed his own account from it.

For context, I don't have an Instagram account. The Facebook account on that computer isn't my real personal account either; it's just a test account I use for experiments.

I don't know what the device was, what exactly it did, or whether it could have accessed anything else on my computer.

My questions are:

What kind of USB device could do this?

Could it have executed commands or accessed files without me noticing?

Is there a risk to my other accounts, saved passwords, or personal data?

What should I check on my PC to make sure nothing malicious happened?

I'm especially interested in hearing from people with cybersecurity or digital forensics experience.

[u/Connect-Fan-9462]

Your classmate likely is what the hacker communities call a "script kiddie", or a "skiddie".

They mostly just buy/download pre-built hacking/security hardware and software/scripts and do it for the heehee.

And that makes them dangerous - they may just want to mess around / test it out, but they have absolutely no idea what the device they bought / script they downloaded really do. For all we care the USB rubber ducky they used may be pre loaded with something way more dangerous.

Personally I will use a read-only boot device to completely wipe and reinstall the OS on that laptop. If there were any "real" account on that laptop I will make sure they are all protected by 2fa. If there were any important work/schoolwork related files I will back them up to a newly created cloud storage account for now and deal with them later.

[u/rifteyy_]

What kind of USB device could do this? A USB rubber ducky

Could it have executed commands or accessed files without me noticing? Yes

Is there a risk to my other accounts, saved passwords, or personal data? Yes

What should I check on my PC to make sure nothing malicious happened? Too many places to cover here, I suggest asking your classmate what it did

[u/ball-and-ball → u/rifteyy_]

thank you ! I doubt if it's possible to ask him since he is always absent . what you suggest i do 

[u/Gytoss → u/ball-and-ball]

School authorities

[u/baselocksec]

Sounds like a BadUSB or Rubber Ducky device, which types keystrokes or runs scripts the moment it's plugged in. The Instagram page opening means it executed commands, so treat the PC as potentially compromised: run a full scan with Malwarebytes or Windows Defender, check your browser's saved passwords, and change credentials for anything that was logged in on that machine.

[u/National_Place_2816 → u/baselocksec]

is such a thing possible for phones or these malwares only exist for pc devices? Like a plug in USB malware for phones

[u/baselocksec → u/National_Place_2816]

Nothing mainstream that I can recall but a quick google search may have a different opinion but there has been plenty of examples of charging cables being used to target phones so I’m sure there is something out there.

[u/National_Place_2816 → u/baselocksec]

I'm surprised these conversations always revolve around "My pc, my pc, my pc" as a tech amateur, I would think criminals would target phones with Sophisticated malware, trojans, etc. Not just through internet but by clicking links and getting onto the phone some how. I download tons of files from the internet on my phone and haven't gotten anything but the moment you download 1 unofficial mod for a game on a PC all of a sudden you've got a Trojan problem not even your antivirus can fix. People store so much more personal information on their phones and it seems to hardly be a target vector other than fake play store apps that .1% of people will experience that only drains their battery. My grandmother had one and it was simply adware doing pop up ads every 2 minutes. I just deleted it without even using an antivirus and it was gone. And that's considered rare and i was able to deal with it in like 2 seconds.

[u/baselocksec → u/National_Place_2816]

It happens a lot for Android especially through malicious apps or APKs. iPhone are much more difficult to the closed-source and a pretty good sandbox environment that handles execution. There is a whole market for buying 0days and especially iPhone exploits that can usually go for six-figures. So it happens. It’s just not wasted on people like you and i. Typically used by the government or other nation state hackers.

[u/National_Place_2816 → u/baselocksec]

yeah in defence of Android though I think there's a huge limit to the variability of malicious apks. the average Android virus is so much less threatening and easy to identify get rid of than the average PC virus. the average PC virus can come in all sorts of extensions but an Android virus will always be a APK as far as I'm aware. I don't even think a malicious Android virus can do anything without asking you for permission first but that's completely unlike PC viruses which get on your PC and do whatever the hell they want. at least this is my experience with phone viruses. I don't know if attackers are simply weak at developing malware for phones that can affect the average person or if these phone companies have created extremely secure devices for your average Joe. whatever they have done to the phones they haven't done the same thing to the PCs and I think it would benefit them to lock computers down a little bit more so people didn't have to stress about antiviruses, especially in hospitals so they don't have to worry about getting zero day attacks. I have heard about Mac being much safer and I wondered why hospitals haven't switched to using Mac computers since I would imagine they have some vulnerability to day attacks like Wanna Cry due to them being a different operating system. maybe the juice isn't worth the squeeze for the execs

[u/baselocksec → u/National_Place_2816]

PCs especially on Windows still need permissions. It just bypasses it essentially through a vast amount of different techniques. Windows OS is well-documented and bypassing most antivirus including Windows Defender, Norton, McAfee, etc cost like $15-$100. Distribution is actually more difficult in terms of quality. Mac is safer but there has been a much more focus on targeting them as of late. Don’t know the state of that though.

[u/National_Place_2816 → u/baselocksec]

Well my understanding is most advanced anti malwares have advanced behavioral detection (Bitdefender, Kaspersky) so even if they don't recognize the malware they cut it off at the behavioral level. seems far too cheap to me that these companies can be beat by either 15 or 100 dollars but maybes that's true. Ive tried looking for hacker groups or malware out of curiosity (not because I do that but I wanted to see is this black market legit?) and all i found were telegram groups that seemed like scams that constantly use the classic "faceless hacker with a black hoodie" or "smiley face hacker mask" its all so cliché i suppose the real stuff is on the dark web not from a google search (no need to tell me ) I'm suspecting though that modern antiviruses are weaker than we think and that most tests are running incredibly common viruses which aren't even in circulation. Like how many bad actors are using cheap trojans and simple keyloggers? It seems like downloading antiviruses are useless because the only way you would even be getting the stuff it can catch anyway is by being stupid and downloading "clean your pc" or "download Minecraft free" crap. I'm still surprised that windows has all those vulnerabilities with the billions of dollars those companies are worth they can't stop hackers from finding new ways to do privelidge escalation or 0 days that come out of nowhere. Ive never heard of an android 0 day but yet every other week theres some dumb cyber article on a new windows threat. They should be doing better than that but whatever.

[u/baselocksec → u/National_Place_2816]

I won’t share any details here but it’s legitimate and I don’t know the inner-workings nor is it a easy job so I can’t speak confidently on it but I assure you they are being beat by $15-$50 malware. $250 is guaranteed beat. Unique heuristics and obfuscation is all it takes. Some companies behavioral detection is just a list of malicious techniques and not actually behavioral detection. But again, i don’t know the inner-workings so take this with a grain of salt.