I read a BBC article about empty USB sticks containing malware:
Berlin-based researchers Karsten Nohl and Jakob Lell said a device that appeared to be completely empty could still contain a virus.
You can hack the firmware of a USB device. With that you can tell the OS whatever you want, eg. the device is empty even it is not. Or attack the USB software stack of the OS by sending data that a normal USB device would not send (so the device could even really be empty, the attack comes from the firmware).
You can also do other funny stuff, like tell the OS that the USB device is also a keyboard, then automatically type commands that do something if it is plugged in. Or tell the OS the USB device is a network card, and redirect all traffic to a server you control.
Endless fun with hacked USB firmwares...
I'm afraid this stems from a misunderstanding from the reporter:
... said a device that appeared to be empty could still contain a virus.
In the video the reporter's referring to it is clear, in fact, in the first two minutes Karsen says he's NOT talking about viruses. He then goes on to demonstrate, on screen, that the seemingly empty USB device is changing itself into a different device (e.g. emulating storage as well as a keyboard and playing keystrokes), as was alluded to in my previous answer (below), but I had not at the time reviewed the full resource to establish it as conclusive evidence.
So there you have it, the author somehow misunderstood the video presentation, and BBC published it...
How can "empty" USB sticks contain malware?
This question doesn't form a clear picture.
Firstly we must define "empty".
Is this only a problem for (legacy) Windows systems?
No. We should consider what constitutes "malware". It's possible for an arbitrary sequence of bytes to be considered malware because it causes damage to one system (e.g. x86/x64 machine code on an x86/x64 prcessor) but not another (e.g. the same bytecode on an ARM/SPARC). To answer this question, we only have to find (or design) a system that decodes the arbitrary sequence as malware, even though it previously wasn't.
Is there some way to use these sticks while protecting yourself?
No. Finally, consider the definition of USB stick. Is it possible that, instead of plugging in a storage device, you might be plugging in some kind of electronic bug, such as a wireless keyboard adapter or a USB thumb killer. Such devices themselves don't really constitute malware, either because they're not software or they weren't designed to be malicious... though they could nonetheless be security risks. It might also be possible for a device to access memory (e.g. by appearing as a charger for your mobile phone and then stealing all of your photos, videos, etc using the data line or a covert wifi network).
Don't insert untrusted USB devices. Period. They might not contain malware, but that isn't the only danger... especially in this day and age where competition, electronic sabotage & surveillance are all the rage.
USB works like this, AFAIK, note where lies could lead the system astray.
Consider USB devices with subverted (reprogrammed) microcontroller...
Computer: +5V, GND
Microcontroller: I am a keyboard.
Computer: OK
Microcontroller: "FORMAT C:" ENTER "Y" ENTER
(Dilbert reference)
Search for the "BadUSB" vulnerability for details.
There is now a GoodUSB gadget: http://hackaday.com/2017/03/02/good-usb-protecting-your-ports-with-two-microcontrollers/
There are several ways to make it appear empty:
Using unsupported characters in file name
Using hiding options for the files
Using the special Windows folders (Like System Information)
In all cases, with a decent file manager you will be able to detect them, but from inside a Windows OS you will only be able to detect them in case 2 and that's if you have enabled it to show hidden files.
Yes, mostly it is a windows OS problem.
Yes, there are ways to protect:
A computer is not just a processor, some RAM, and a hard drive. There are many processors inside a computer, including USB host processors, keyboard processors, clock processors, address bus processors, IDE/SATA processors, and more.
A "completely empty" USB stick could be reporting 0 files and folders in a single partition, even if it were, say, a keyboard programmed to advertise itself as a mass storage device.
There's a lot of trust that goes on at the hardware level for most processors. The firmware on many USB sticks are designed with the idea that they won't be programmed by end users. The firmware on many USB hosts also assume they won't be programmed by end users.
In other words, a user with sufficient technical skill could write their own code on to a USB stick, which in turn could write a payload to the USB host processor, which in turn could be used to subvert other systems through common buses.
This environment only exists in the first place because most processors include non-volatile RAM that they use as a ROM for storing their code. This allows vendors to build the hardware first, then drop the software in later. It's far more money efficient then building the software directly into the hardware.
So, with all that in mind, here's the answers you probably don't want to hear:
How can "empty" USB sticks contain malware?
Just because the OS sees something as empty doesn't mean it is. At minimum, it has firmware code running in a processor that starts up the millisecond the device has power. All USB devices have memory, even keyboards, mice, and sound cards. If it were really empty, the device wouldn't work.
However, if the device reports itself as a storage device, and the OS queries the partition table, the device can then simply send whatever data it wants, including appearing to be empty, or having an arbitrary storage capacity etc. Even today, you can find scammers that sell under-capacity storage devices that are re-programmed to report more capacity than they have. For example, you might buy a 32 GB stick that actually only has 2 GB of physical storage. The firmware lies to the OS, which eventually results in corrupt data when the user tries to use more than (for example) 2 GB of storage.
Is this only a problem for (legacy) Windows systems?
No. This is a problem for virtually every hardware device on the market. Some people estimate that this may be as high as 90% or more of devices, including laptops, tablets, phones, desktops, mp3 players, and anything else that has USB firmware in it. There's at least one manufacturer I've heard of that has "hardened" their firmware against reprogramming. A simple Google search will find storage devices that are resistant to reprogramming.
Is there some way to use these sticks while protecting yourself?
No. In fact, unless you examine every firmware's code before you plug it in to your computer, and, in fact, read your computer's firmware code before you plug anything into it, you can't be certain. It's entirely possible that your device was infected by the NSA before it was shipped to your store and sold to you. It might even be infected even if you bought all the hardware piecemeal and built it yourself. Unless you've physically created and programmed every aspect of your computer yourself, there's absolutely no way to be perfectly safe.
The best you can do is establish some level of trust, and avoid risky behavior. Avoid buying open hardware on e-bay, unless you reasonably trust the seller. Prefer buying brand-name computer parts instead of knockoff imitations, unless you can be reasonably sure they're safe (i.e. do research). Use as few devices as possible, and avoid sharing your devices with people you don't know. In other words, take the same precautions you'd take when trying to buy food, a car, or anything else. Most hardware is not currently infected, only because there's easier ways to get someone's data, but you should avoid casual exposure to risks.
The USB stick itself could be the virus, not the data on its flash memory.
Let me show you how:
You could use the remaining endpoints to emulate a keyboard or mouse.
If done right, the user only notices a seemingly empty flash drive. So no way to delete the virus without modifying the USB firmware
Several good answers above - another related to waltinator's answer would be something like a USB ruberducky this could have malware in a hidden partition that it would deploy while displaying an empty partition.
Because of corrupt data. Anything that can write itself to memory can in theory save itself without any user interaction. By this definition you could say Windows itself is malware because anytime you plug in a drive or usb, it writes a few invisible bytes that could contain anything. Anywhere from backup info needed by the os or even rogue software that copies itself to anything writable. In the 90's floppy disks had a physical thumb insert which you could flip like a switch, flipping it to a locked position would cause data not to be writable to the disk. Nothing like this exists for usb drives, though I'm sure there's probably software than can allow you to lock drives. In Linux nothing is auto mounted unless it's setup that way, if you catch malware on removable hardware it's a Windows problem.
My short answer: It is easy to fudge data to make something appear to be something it is not.
This can be done maliciously or just as a byproduct of a different application.
Case in point of accidental byproduct. I have a 16gb USB3 stick which I made into a bootable USB of Kali linux. The program I used ended up making the unused space into an unallocated partition so now the system only saw the stick as being the total space that the ISO data took up. I ended up having to use a 3rd party partitioning program to repartition the entire stick and get the 16gb total.
dd if=/dev/null of=/dev/sdb would erase the full device not only the part covered by ISO9660).