BadUSB attacks: why you should never plug in a USB drive you found

You're walking through a parking lot when you spot a USB drive on the ground. Maybe it has a label on it, "Vacation Photos" or "Tax Documents 2024." Your first instinct might be to pick it up and see if you can find the owner.

Don't plug it in.

That small piece of plastic could be a BadUSB device, a cheap and surprisingly effective attack tool. And the moment it touches your laptop, the damage may already be done.

What is a BadUSB attack?

A BadUSB attack doesn't work the way most malware does. It doesn't hide files on a drive waiting for you to click something. Instead, it targets the USB device's firmware, the low-level code that tells your computer what kind of device it's talking to.

When you plug in a regular flash drive, your computer recognizes it as storage. A BadUSB device lies. It tells your computer it's a keyboard, a trusted input device, and your computer believes it completely.

From there, it starts "typing." In seconds, it can open a command terminal, run scripts, download malware, and install a backdoor. It all happens in seconds, often in windows that flash by too fast to notice, before you've even opened a file browser. According to Ivanti, the entire sequence from plug-in to compromised system can unfold in under five seconds.

The attack was first publicly demonstrated in 2014 when researchers Karsten Nohl and Jakob Lell showed at Black Hat USA that USB firmware could be reprogrammed for malicious use, and that most USB controllers had no way to check whether their firmware was genuine.

Why antivirus alone can't catch it

This is the part that catches most people off guard.

Your antivirus works by scanning files. It looks for known malicious code patterns in what's stored on a device. A BadUSB attack lives in firmware, not in files. There's nothing to scan. The malicious instructions aren't sitting in a folder. They're baked into how the device identifies itself to your system.

So when your computer sees a BadUSB device, it doesn't see a threat. It sees a keyboard. And it does what it always does with keyboards: it trusts it completely.

As Wikipedia's BadUSB entry explains, once a reprogrammed USB is plugged in, the computer automatically recognizes it and allows it to interact, just like a legitimate keyboard. There's no signature check, no authentication, and no alert. Your security software may still catch the malware the device downloads afterward, but by then the attacker has already had a few seconds at your keyboard.

Real attacks in the real world

BadUSB attacks aren't just a lab experiment.

In 2020, a US hospitality company received a letter in the mail that appeared to come from Best Buy, along with a $50 gift card and a USB drive. The letter said the drive listed the items the gift card could be used on. Security researchers at Trustwave investigated and found that once plugged into a test machine, the USB triggered a PowerShell command, downloaded a script, and installed a JScript-based bot linked to the hacking group FIN7, according to ZDNet.

The company didn't fall for it, and the attempt was reported to Trustwave. In 2022, the FBI warned that FIN7 was mailing similar USB drives to US businesses in the transportation, insurance, and defense industries, some disguised as Amazon gifts or COVID-19 guidance from the Department of Health and Human Services (Dark Reading).

Banks have been hit too. In 2017 and 2018, attackers behind a campaign Kaspersky named DarkVishnya walked into at least eight banks in Eastern Europe posing as couriers or job seekers. They hid small devices on the banks' networks, including a Bash Bunny, a USB attack tool the size of a flash drive, and used them to steal tens of millions of dollars (Kaspersky Securelist).

The 48% problem

Here's an uncomfortable truth: a lot of us would plug in a USB drive we found.

In 2016, researchers from the University of Illinois tested this by dropping nearly 300 USB drives across their campus, in parking lots, hallways, classrooms, and public areas. They tracked which ones got picked up and plugged in. The results were striking: 48% of the drives were not only plugged in but had at least one file opened, according to researcher Elie Bursztein.

The first drive was connected within six minutes of being dropped.

When surveyed, 68% of the people who plugged in a drive said they did it to find the owner and return it. Altruism is exactly what attackers count on. Attackers label drives "Medical Records" or "Company Payroll" to make them feel urgent and personal. It plays on our instinct to help.

Security knowledge didn't seem to help either. The researchers found no difference in security knowledge or education between the people who plugged in drives and the wider campus population.

What a BadUSB can actually do

Once connected, the limits are mostly what you'd expect from having someone sitting at your keyboard, except they're invisible, automated, and done in seconds. A BadUSB device can:

• Open a terminal window and run commands with your account's permissions, or with administrator rights if your account has them
• Download and install malware, including ransomware, keyloggers, or remote access tools
• Steal files and credentials stored locally on the machine
• Change DNS settings so your traffic routes through a malicious server
• Spread laterally across your home or office network
• Establish a persistent backdoor so the attacker can return even after the USB is removed

Modern BadUSB variants have gotten harder to spot. Some are hidden inside ordinary-looking USB cables, not drives. The OMG Cable, for example, looks like a standard charging cable but contains a hidden Wi-Fi chip that lets an attacker send commands remotely, no physical USB drive in sight.

How to protect yourself

You can't rely on antivirus alone here. The good news is that the most effective protection is also the simplest.

Don't plug in USB drives you didn't buy yourself. This is the core rule. A drive you found in a parking lot, received in an unsolicited envelope, or picked up at a conference swag table is a drive you don't trust. No matter what's written on the label.

Disable AutoRun and AutoPlay on your Windows computer. These features used to automatically run programs when a USB was inserted. Turning them off removes one layer of exposure, though it won't stop keyboard emulation attacks.

Use USB data blockers when charging from public ports or unfamiliar cables. These small adapters pass power but block the data pins entirely. Your device charges, but no data gets through.

Keep your operating system updated. Updates won't stop keystroke injection, but they close the known vulnerabilities that malware dropped by a BadUSB often relies on.

Lock your screen when you step away. Keystroke injection needs an unlocked session, so a locked computer gives a plugged-in BadUSB nothing to type into.

Use a standard user account for everyday work. If the account you're logged into doesn't have administrator rights, a BadUSB can do far less damage.

If you work in an organization, talk to your IT team about USB port policies. Disabling USB ports on endpoints or using device management software to allow only approved hardware is one of the most reliable defenses available.

And if you ever receive an unexpected USB drive in the mail, especially alongside something that seems like a gift or reward, treat it as a red flag and report it. The FBI has warned businesses that receive unexpected USB drives in the mail not to plug them in and to report them to the FBI.

The real risk is the trust we give by default

Your computer trusts any device that says it's a keyboard. That default trust is what makes BadUSB work, and it's why your habits matter more than any single tool.

• A BadUSB device pretends to be a keyboard and types commands in seconds.
• Antivirus can't scan firmware, so it won't flag the device itself.
• In one study, nearly half of dropped drives were plugged in and opened, mostly by people trying to help.
• Never plug in a USB drive you didn't buy, and report unexpected drives that arrive in the mail.
• Lock your screen, use a standard account, and keep your system updated to limit the damage.

Conclusion

Most people don't think twice about plugging in a USB drive. It's been a normal, everyday action for decades. That's exactly why BadUSB works.

The attack doesn't need you to click anything, open a file, or ignore a security warning. It just needs a moment and a port. Your computer does the rest, because it was built to trust keyboards.

The fix is mostly about habits. The next time you find a USB drive, leave it alone or hand it to a lost-and-found desk without plugging it in anywhere. A drive that isn't yours is a drive you don't know, and a few seconds is all it needs.

Guardio can't stop a device you plug in yourself, but it helps with the threats you meet online every day. It works on your computer and on your iOS or Android phone, blocking dangerous sites, downloads, and phishing emails, filtering scam texts on iPhone, and alerting you if your personal information shows up in a data breach. Get a free security scan with Guardio today and see where you're exposed.