I would like to ask about "BadUSB" vulnerability real world attack vectors. I got this idea, because I use virtual box as a sandbox for checking incoming files from clients (I am not an exposed person and I am not doing anything sensitive - it's just a common precaution because I communicate with a lots of people and a lots of people doesn't too much care about PC security and I simply find using virtual machines convenient) and I have usually a USB card reader connected to the virtual machine. A assume that due to wide expansion of unsecure microcontrollers some of these devices may be potentially vulnerable to the BADUSB kind of attack too (and there is basically no way to find it out).

And I am curious - is using a USB device in a sandbox inappropriate? Does it mean that e.g. when I accidently launch a malware in my virtual machine, it may use BadUSB technique and "hide" itself in my card reader’s firmware like MBR viruses in MBR partition some years ago? Or is this attack "reseved" only for specific attacks when bad guys plants malicious devices in a parking lot of some company or send "a gift card with free flashdisc" to specific person. And malware does not use it to conceal itself - thus using a card reader in a sandbox is not a problem.

Thank you for your opinions in advance.

2 Answers 2


A virtual machine machine is not a silver bullet. There are VM escape attacks. But it's probably decent mitigation for "accidental" attacks. If your threat estimation calls for it, keep it up.

For a BadUSB attack to inhabit (posses?) your card reader, your card reader would need to be vulnerable. Malware cannot magically infect. If the card reader is an ASIC with zero writable memory for instance, it cannot infect it. If it has an authenticated update procedure and zero useful vulnerabilities, it cannot infect it.

BadUSB is probably a targeted attack. Garden variety malware likely doesn't use BadUSB to hide itself. There's no reason it couldn't I guess other than the extra work of implementing the feature for the few times it comes across vulnerable USB with enough updatable portion for original firmware + malware with original payload and a BadUSB mechanism. The most heinous malware is a business that relies on mass or targeted infection. BadUSB probably falls on the latter end of the spectrum.

  • Thanks! Not afraid of the magic :) but I cannot judge from the available sources if is this threat is common and e.g. used by malware as hiding and evasion technique (thus even a common user like me should be prepared) or is used only in a focused attacks (outside my threat model). According to some sources (1) the exploite needs to be written for every specific device, but according to others (2) it sounds to me that there are typically ICs like Phison 2303 which were/are generally used - so I understand it that one exploit may cover larger number of devices.
    – M_Ryan
    Commented Jun 9, 2022 at 7:26
  • (1) security.stackexchange.com/questions/239972/… (2) researchgate.net/publication/… PS: I use VMs also because easy upgrading and separation of my work - I'm messy and this way I can have a totally different environment for any project I do - just handy :)
    – M_Ryan
    Commented Jun 9, 2022 at 7:28
  • Both 1 and 2 can be true. The exploit does need to be written for every device. In the case of the 2303, that is the device and it unfortunately was packaged in a few products. Five per a GitHub project tracking it's use and even then reports that the chip is being phased out even for those products. So a garden variety malware would need to carry around the attack for each and every device (think IC not product) it hopes to infect, knowing it may have limited, waning effectiveness. Its certainly possible and we may never know how common but I'd wager it's more of a targeted attack.
    – foreverska
    Commented Jun 9, 2022 at 13:55

I think there is a need to clarify things up. BadUSB is a USB mass storage device reprogrammed to act as USBHID keyboard (mass storage capability is lost). So, in a nutshell, you are plugging a keyboard with prerecorded keystrokes to your virtual machines, and the answer to your question depends if your virtualization software supports hotkey switching from running guest OS to the host OS and is likely yes, it's risky.

  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Jun 15, 2022 at 20:09
  • Hello, downvoter, w/o specific criticism I think my answer is just fine. Commented Jun 15, 2022 at 20:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .