Menu Close

USB Security 101: BadUSB, autorun risks, and device control policies

Mark Collins
USB Security

USB “just works,” which is exactly why attackers love it. A $12 dongle can masquerade as a keyboard, a flash drive can hide a booby‑trapped shortcut, and a public charging port can negotiate a data link you did not intend. This guide explains the real risks—BadUSB, autorun‑style tricks, and social attacks—and shows how to harden Windows, macOS, and Linux. You will also get practical device control policies for businesses, and a short incident response checklist if someone plugs in the wrong thing.

Understand the threat landscape

BadUSB in plain English

BadUSB is not a virus in a file; it is a device pretending to be something else. Many USB sticks and adapters contain small microcontrollers you can reprogram. Reflashed, they can:

  • Emulate a keyboard and “type” commands faster than a human.
  • Spin up as a network adapter, set themselves as your default route, and hijack traffic.
  • Present as multiple devices at once, such as a read‑only CD and a writable disk.

Concrete example: A “Rubber Ducky”‑style device plugged into an unlocked PC opens PowerShell, fetches a script, and creates a new admin user in seconds. No file scan helps because the keyboard was the weapon.

Autorun is “off,” but click‑to‑run tricks remain

Windows disabled autorun for USB years ago, yet attackers still succeed with shortcuts, double extensions, and fake “drivers.”

  • A hidden EXE sits next to a legitimate‑looking .lnk. You double‑click the link; malware runs and opens a decoy folder so you do not notice.
  • Some devices emulate a CD‑ROM to trigger legacy autorun behaviors in niche setups.
  • Files named “invoice.pdf.exe” rely on hidden extensions to trick hurried users.

Concrete example: A drive labeled “Q4 bonuses” contains a folder icon that is really a .lnk pointing to cmd.exe /c start payload.exe && start real_folder. You think you opened a folder; you launched malware.

“Juice jacking” is data by accident

USB carries power and data on the same pins. Public charging kiosks, rental cars, or unknown hubs can ask to pair or transfer data. Newer phones prompt you, but muscle memory is not a control.

Concrete example: You plug into an airport kiosk. Your phone flashes “Trust this computer?” If you tap yes, you opened a data channel. If you use a power‑only cable, there is no data to trust.

Harden personal devices first

Windows 10/11: turn on the right controls

Disable automatic behaviors, block execution from removable media, and prevent unapproved USB storage from installing.

  • Turn off AutoPlay: Settings > Bluetooth & devices > AutoPlay > Off. In Group Policy: Computer Configuration > Administrative Templates > Windows Components > AutoPlay Policies > Turn off AutoPlay = Enabled (All drives).
  • Block executable content from removable drives (Defender ASR rule):
    • Windows Security > App & browser control > Reputation‑based protection > Block > “Block executable content from removable drives,” or via PowerShell:Add-MpPreference -AttackSurfaceReductionRules_Ids 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC -AttackSurfaceReductionRules_Actions Enabled
  • Deny execute on removable disks (Group Policy):
    • Computer Configuration > Administrative Templates > System > Removable Storage Access > Removable Disks: Deny execute access = Enabled.
  • Prevent installation of new USB storage:
    • Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions > Prevent installation of removable devices = Enabled.
  • UEFI/BIOS: disable “Boot from USB,” enable Secure Boot, and set a firmware password. This blocks live‑USB bypasses.

Concrete example: With ASR and “deny execute” enabled, a .lnk on a flash drive cannot launch its hidden payload. Windows logs the block, and you still can copy benign files off the drive.

macOS: control mounting and new interfaces

macOS does not auto‑run from USB, but it will accept whatever plugs in unless you say otherwise.

  • FileVault: keep it on. A powered‑off Mac with FileVault is unreadable if stolen.
  • Firmware password: set one to block USB booting without authorization.
  • MDM profile (work devices): require encryption for external media or block it entirely; restrict which apps can access removable volumes (PPPC).
  • Network: watch for surprise USB Ethernet interfaces. System Settings > Network shows services; delete unknown adapters.

Concrete example: Your MDM baseline allows only encrypted external drives to mount. A random USB stick will not appear unless IT authorizes a one‑time exception.

Linux: mount safely and restrict drivers

Treat removable media as hostile unless proven otherwise.

  • Mount with safety flags (noexec,nodev,nosuid) so binaries cannot run from the stick:# /etc/fstab example UUID=XXXX-XXXX /media/usb vfat defaults,noexec,nodev,nosuid,uid=1000,gid=1000 0 0
  • udev rules: restrict USB classes or allowlist specific vendor/product IDs on kiosks.
  • Blacklist mass storage module if unneeded:echo "install usb-storage /bin/true" | sudo tee /etc/modprobe.d/usb-storage-blacklist.conf
  • Firmware/BIOS: disable USB boot; require password for setup.

Concrete example: On a lab box, noexec prevents .sh or .bin files from launching off USB. Users must copy installers to a scanned folder first.

Create device control policies that work

Decide what to allow by default

A sensible baseline for offices:

  • Allow: standard keyboards and mice, printers, headsets.
  • Block by default: USB storage, USB network adapters, and serial adapters.
  • Allow by exception: specific encrypted USB drives (by serial), approved USB‑serial adapters (by vendor/product ID).

Implement with your endpoint platform:

  • Microsoft Defender for Endpoint (Device Control), Intune device restrictions.
  • CrowdStrike, Bitdefender GravityZone, ESET Protect, Symantec Endpoint Security.
  • Jamf for macOS fleets.

Policy features to adopt:

  • Allowlist by vendor/product ID and serial number.
  • Require encryption on any removable storage that mounts.
  • Log and alert on new device classes; start in audit mode for two weeks.
  • Temporary exceptions expire automatically; permanent exceptions require two approvals.
  • Document exceptions and measure usage.

Examples:

  • Kiosk PCs: block all USB except a specific keyboard/mouse VID/PID; deny storage entirely.
  • Field engineers: allowlist one model of USB‑serial adapter; deny all USB Ethernet; require encrypted drives for logs.
USB Security

Reduce charging and pairing risks

  • Use a power‑only cable or a USB data blocker when charging in public. These physically disconnect data pins.
  • Prefer an AC outlet and your own charger. Assume public USB ports can request data.
  • iPhone: Settings > Face ID & Passcode > Accessories = Off (USB Restrictions). Locked devices will not talk to USB by default.
  • Android: keep USB debugging off; in Settings > Connected devices > USB, set default to “No data transfer.”

Concrete example: In a rental car, charge via the 12V outlet or a power‑only cable. Car infotainment systems sometimes retain paired phone contacts and call logs.

Train people to ignore curiosity

Social engineering is the most reliable USB attack.

  • Never plug in “found” USB sticks. If reading unknown media is part of your job (journalism, law enforcement), use a dedicated “dirty” laptop or a write‑blocked reader in a sandboxed VM.
  • Verify any “support” visit that requires plugging in a dongle. No badge, no plug.

Consider an internal “USB drop” drill once a year if your environment allows. Use the results to coach, not punish.

Build a short incident response runbook

If someone plugs in a suspicious device or the system pops odd prompts, treat it like an intrusion.

  • Contain: disconnect from Wi‑Fi/Ethernet. If a keystroke attack is active, power down immediately. If you may need memory evidence, isolate the device and consult IR leads.
  • Triage (Windows): Device Manager for new HID or network adapters; Event Viewer > Applications and Services Logs > Microsoft > Windows > DriverFrameworks‑UserMode for device install events; C:\Windows\INF\setupapi.dev.log for device history.
  • Hunt (Windows): Run Sysinternals Autoruns to review new run keys, scheduled tasks, and services; check PowerShell Operational logs (Event IDs 4103/4104); verify proxy settings and trusted root CAs.
  • Triage (macOS): System Settings > Login Items; inspect ~/Library/LaunchAgents, /Library/LaunchAgents, /Library/LaunchDaemons; check Profiles for unknown payloads.
  • Remediate: remove rogue adapters, reset network settings, revoke suspicious certs, and run your EDR/AV. Rotate credentials typed during the exposure window.
  • Report: capture the device’s vendor/product ID, serial, and user account; add the fingerprint to your block list.

Concrete example: A user reports a “USB Ethernet” device appeared for a few seconds. Logs show a new adapter installed at 10:41 a.m. You remove the driver, reset network configs, check for a rogue proxy, run an EDR scan, and rotate the user’s password.

Quick hardening checklists

Windows

  • AutoPlay off; Defender ASR “Block executable content from removable drives” on.
  • Removable Disks: Deny execute access; Prevent installation of removable devices.
  • Device Control: block USB storage by default; allowlist approved serials.
  • UEFI: Secure Boot on; disable USB boot; set firmware password.

macOS

  • FileVault on; firmware password set.
  • MDM: require encryption for external media or block by default; restrict app access to removable volumes (PPPC).
  • Monitor for unknown USB Ethernet interfaces.

Linux

  • noexec,nodev,nosuid on removable mounts.
  • Blacklist usb-storage if not needed; use udev to limit classes or allowlist devices.
  • Disable USB boot in BIOS; require a setup password.

Policy that people can live with

  • Make “no storage, no network adapters” the default. Provide fast, documented exceptions.
  • Pair device control with DLP: allow only encrypted drives and scan for sensitive data on copy events.
  • Test with real users before enforcement. Include dock, keyboard, and webcam vendor IDs in allowlists, or you will break someone’s day.
  • Start in audit mode for two weeks; review logs; then enforce.

Concrete example: Finance needs to move encrypted backups off a workstation once a week. You issue FIPS‑validated drives with unique serials, approve them via device control, and block everything else. The drives auto‑mount; unknown sticks do nothing.

Summary

USB is a convenience layer and a trust boundary. BadUSB abuses identity, not files. Autorun exploits your clicks, not your policies. The fix is layered and short: block execution from removable media, turn off AutoPlay, require encryption for any allowed storage, and restrict which USB classes can attach. Add simple habits—power‑only cables in public, no mystery sticks—and teach people what a keyboard attack looks like. In 20 minutes, you can convert “just plug it in” from a risk into a controlled, auditable workflow.