Why removable media is still a way in
Air gaps and locked-down workstations push attackers toward the one channel people still carry by hand. A USB device crosses every network boundary in a pocket, and most hosts accept it the moment it is plugged in.
Case in point · 2010
A worm that reached industrial controllers through infected removable drives showed that an isolated network is only as isolated as the media that enters it.
Four families of USB attacks
Researchers group USB attacks by what the device pretends to be and how it reaches the host. The families below overlap, but each needs a different defence.
Purpose-built injectors
Hardware designed from the start to emulate a keyboard and replay a stored payload.
Reflashed peripherals
Ordinary devices whose firmware was rewritten so they announce a different class.
Abused standard devices
Unmodified hardware misused through drivers, autorun features or storage tricks.
Electrical attacks
Devices that discharge stored energy into the port to destroy the host.
Grouping adapted from public academic surveys of USB-based attacks.
How the host decides what a device is
When a device is attached, the host asks it to describe itself. The answer includes a class code, and a device that answers "keyboard" is trusted as a keyboard. Nothing in the protocol checks that a person is behind the keys.
Anatomy of a keystroke injection
The attack needs only the time it takes to type. Because the input arrives through the keyboard path, application allow-lists and many endpoint rules treat it as the user.
Keystroke injection, step by step
Insert
A device that looks like storage is connected to an unlocked host.
Enumerate
It reports itself as a keyboard and the host loads the generic driver.
Type
A stored script sends hundreds of keystrokes per second.
Run
The commands execute with the logged-in user's rights.
Reproducing it in the lab
For the demo we wrote a short payload that opens a terminal, writes a marker file named u515_marker.txt and closes the window again. The whole sequence finishes before the window has fully drawn.
# Payload logic, expressed as the shell commands it types
cd "$HOME"
printf 'keystroke injection test\n' > u515_marker.txt
exit
What actually stops it
Blocking storage classes does not help, because the device never acts as storage. Effective controls look at device class, timing and where the media is inspected before it reaches a production host.
- Inspect media at the edge. Scan removable media at a dedicated station before it is allowed inside the facility.
- Allow-list device classes. Refuse new keyboard-class devices on hosts that never need one.
- Watch typing cadence. Flag input that arrives faster than any person can type.
- Lock idle sessions. An injector is useless against a locked screen.
A media inspection workflow fits into three short steps for the people carrying the media:
Insert media
Scan and sanitize
Review the report