USB made hardware simple: plug it in, and it works. That same promise is what makes it risky. A port designed to accept almost any device and trust what it reports can be turned against the machine it is meant to serve. BadUSB is one expression of that problem: malicious hardware presents itself as a keyboard or mouse, then uses that trusted role to send commands and take control of the target system.
A different kind of USB attack
Traditional USB attacks treat the drive as a delivery container. The device stores malware, and the attack begins only when someone opens or runs a malicious file. Stuxnet, for example, spread through infected removable drives. In that model, the USB stick is passive. It carries code; it does not act on its own.
BadUSB changes the role of the hardware. The device is not a storage volume with a payload inside. It is the payload. When plugged in, it actively deceives the operating system, presents itself as a trusted human interface device (HID), and starts issuing pre-programmed commands. There is no file for the user to launch and no prompt to approve. The action begins at insertion.
How the deception works
The attack depends on the way USB devices are recognized. When a device connects, the host runs through enumeration. During this exchange, the device sends descriptors that describe what it is and what it can do. The operating system reads those descriptors and loads the matching driver.
The weak point is that the operating system does not have an effective way to verify that the description is truthful. An attacker can rewrite a device's firmware so that the descriptors no longer match the actual hardware. A microcontroller, for instance, can announce itself as a keyboard. The host sees a keyboard descriptor, accepts the device as a new keyboard, and prepares to receive keystrokes. It has no reason to suspect that the hardware is not what it claims to be.
The attack sequence
- Firmware rewrite: The attacker takes a USB device whose firmware can be modified and flashes malicious firmware onto it.
- Device disguise: That firmware includes forged HID descriptors.
- Automatic execution: When the device is inserted into the target computer, enumeration is fooled. The system identifies the hardware as an HID device such as a keyboard.
- Malicious input: The device begins sending simulated keystrokes at a speed far beyond human typing. It can open PowerShell and run predetermined commands.
Once the machine accepts the device as a keyboard, the rest is a matter of input. The operating system is not watching for a keyboard that types too fast or one that was not there a moment ago. The commands arrive as ordinary keystrokes from a trusted device. This is why BadUSB can bypass conventional antivirus tools and other defenses: the attack is not arriving as a file to scan. It is arriving as input from hardware the system has already accepted.
A few seconds is enough
Keyboards, mice, and power banks can all be modified with malicious code. Everyday life depends heavily on USB, and that dependence helps this kind of attack succeed. A device can be connected for only a few seconds. While the user steps away, an attacker can plug in a prepared USB device, let it issue its commands, and leave the machine compromised. The interface is familiar; the trust is built in; the attack exploits both.