BadUsb works by infecting a computer when plugged into the USB port. Is it also possible for an attacker who gains control of a system, such as remote access, to then infect any connected USB devices? Or does it only affect the ports it's plugged into?

  • At least for Phison based devices (around half of devices), as long as an attacker has Administrator/root privileges, they would be able to place the device in boot mode and update the firmware. Local or remote doesn't matter. Oct 18, 2014 at 3:37

2 Answers 2


Once an attacker gains control of a system he may use it to try and compromise vulnerable USB devices plugged into it in hopes of compromising the other systems to which the compromised USB devices will be connected.

And the attacker doesn't care about which ports are used, he'll just probe all of them in hopes of finding & compromising a vulnerable USB device.

  • marked this as correct because I feel it answers the question with more accuracy, but I appreciate both responses. Oct 20, 2014 at 20:23

If a USB stick accepts unsigned firmware updates then yes it's vulnerable to a bad USB attack. There are products out there that only accept digitally signed firmware updates. These devices are not susceptible. http://www.ironkey.com/en-US/solutions/protect-against-badusb.html

  • If USB stick includes basic storage sticks, what firmware would it have and how are the stick autonomous enough to accept or reject firmware? Oct 17, 2014 at 22:05
  • "As explained by the researchers, the best protection against this vulnerability is to use code signing for firmware updates. If the signed firmware is modified, the device cannot authenticate the firmware and simply will not operate. This prevents the infection from spreading but results in an unusable device. That is why in addition to using signed firmware, IronKey protects the mechanism used to update the firmware with hardware-based security keys. This prevents tampering with the signed firmware, which would leave the device unusable."
    – k to the z
    Oct 17, 2014 at 22:09
  • But is IronKey more autonomous than than normal flash eeprom? I would have thought for normal flash device that decisions on firmware validity are made by the host operating system. Oct 17, 2014 at 22:14
  • 1
    At least for Phison controllers (about half of devices), there's a boot image that loads the firmware from NAND and executes it; it's that boot image that should perform validation - it's likely this check isn't done to improve performance. The host PC has no idea what's executing on the drive - that's what makes this technique so effective. Oct 18, 2014 at 3:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .