BadUSB: how a USB drive becomes a hacker keyboard (and defenses)

In January 2022, the FBI warned US companies about packages arriving in the mail with a USB drive inside: sometimes a fake letter from a health department about COVID rules, sometimes a gift box "from Amazon" with a free gift card. Whoever plugged the device into a computer saw no files. What happened was worse: the "USB drive" presented itself as a keyboard and started typing on its own. That is BadUSB.

What is BadUSB?

BadUSB is a class of attack in which a USB device declares itself to the computer as a different kind of device — usually a keyboard — and starts "typing" commands the user never wrote. The operating system trusts keyboards by default, so it accepts the input without asking for permission.

The name comes from the research presented by Karsten Nohl and Jakob Lell of SR Labs at Black Hat USA on August 7, 2014. They reverse-engineered the firmware of the microcontroller inside ordinary USB drives and showed it could be rewritten. The malicious code lives in the firmware, not in the flash memory where files are stored. Erasing the contents or formatting the drive removes nothing, and antivirus products at the time did not scan that firmware. According to coverage by Security Affairs and eWeek, the demo included a drive that impersonated a keyboard and even one that posed as a network card to change the machine's DNS.

How does a USB drive become a keyboard?

Every USB device reports its class to the computer when plugged in: storage, audio, network, or HID (Human Interface Device, the class for keyboards and mice). The firmware decides what the device claims to be. A device with modified firmware can declare itself HID and send pre-recorded key sequences at machine speed.

Ready-made versions are sold openly for authorized penetration tests: the USB Rubber Ducky from Hak5 looks like a flash drive and uses its own scripting language (DuckyScript) to define what gets "typed". There are also cables with the electronics hidden inside the connector, such as the O.MG Cable. From the victim's side, it all looks like an ordinary charger or flash drive.

The trick works because whatever "types" has the same permissions as the logged-in user. A typical payload opens a terminal, downloads something from the internet and runs it. If the user is an administrator, the damage is bigger.

The FIN7 case: BadUSB by mail

The FBI alert, reported by Bleeping Computer on January 7, 2022, attributed the mailings to the financially motivated group FIN7. The packages, sent via USPS and UPS, targeted transportation and insurance companies and, from November 2021, defense-sector firms. The devices were LilyGO boards sold online and, according to the FBI, they registered as a keyboard, which works even with removable storage disabled. The commands were PowerShell used to download and install malicious payloads, including ransomware, as reported by Bleeping Computer, Bitdefender and Tripwire.

The lesson here is social engineering: the technical part is mundane; what makes the attack work is the convincing packaging and the recipient's curiosity.

Is BadUSB the same as juice jacking?

No. In juice jacking the attack comes from a compromised public charger or port; in BadUSB the attack is inside the very device you plug in. Both exploit trust in USB ports, and the defenses overlap. The post on juice jacking covers the other side of the coin. A keylogger is a common destination for these attacks: the first command typed often installs something that stays behind.

How to protect yourself from BadUSB

• Never plug in a USB drive you found, received in the mail, or got as a conference giveaway. It is the cheapest and most effective defense.
• Lock your computer when you step away (Windows + L). A device plugged into a locked machine has far less to work with.
• Don't work as administrator day to day. A standard account limits what the typed commands can change.
• Disable USB ports nobody uses on servers and fixed-use machines (BIOS/UEFI or corporate policy).
• In companies, use an allow-list of devices. Blocking only "removable storage" is not enough, because BadUSB shows up as a keyboard.

How to detect it on Windows

To see which keyboards Windows currently recognizes, use PowerShell:

Get-PnpDevice -Class Keyboard -PresentOnly | Select-Object FriendlyName, InstanceId, Status

If a keyboard shows up that you didn't connect, investigate. To keep a history, enable Plug and Play event auditing. It generates event 6416 ("A new external device was recognized by the system") in the Security log:

auditpol /set /subcategory:"Plug and Play Events" /success:enable
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6416} -MaxEvents 10

The subcategory name changes with the Windows display language; check it with auditpol /list /subcategory:*. The post on PowerShell audit logs helps you record what those typed commands executed.

For real blocking in a corporate environment, Group Policy has the Device Installation Restrictions rules (Computer Configuration, Administrative Templates, System, Device Installation), which let you allow only specific IDs or classes. Test first: a badly written rule also takes down your legitimate keyboard and mouse.

What about Linux?

On Linux, USBGuard keeps a list of authorized devices and blocks the rest. Install it from your package manager, generate a policy from the devices currently connected, and list what the system sees:

sudo apt install usbguard
sudo usbguard generate-policy | sudo tee /etc/usbguard/rules.conf
sudo systemctl enable --now usbguard
sudo usbguard list-devices

Generate the policy on a clean laptop with only your own peripherals connected. From then on, any new device stays blocked until you authorize it with usbguard allow-device.

The bigger lesson

BadUSB exposes a design flaw: USB was born to be plug and play, and the computer believes what the device says about itself. Back in 2014 the research already warned there was no simple fix, and Nohl's recommendation was to treat any USB that has touched an untrusted computer as contaminated. Twelve years later, the defense is still behavior: don't plug in what you don't know, and limit what each port accepts. If you want to continue on the hardening side, also see the guide to 10 settings to make Windows 11 safer.