The USB Stick That Types: BadUSB, Bad Cables and Juice Jacking
By Thomas Lovas Lokoy · Published August 9, 2026 — researched and drafted with AI assistance from published sources; edited and published by NorwegianSpark SA.
There is one design decision at the root of this entire class of attack, and it was made long before anyone thought of it as a security question. When you plug something into a USB port, the device tells the computer what it is. The computer believes it. There is no certificate, no challenge, no proof — the device simply declares "I am a keyboard" and is treated as one from that moment on.
That is not a bug anybody can patch, because it is what makes USB usable. It is also why a device shaped like a memory stick can behave like a very fast typist.
What the attack actually is
Researchers Karsten Nohl, Sascha Krißler and Jakob Lell presented this publicly at Black Hat in 2014 under the name BadUSB. Their point was broader than one trick: the firmware on ordinary USB controllers can be rewritten, so a device's identity is software, and software can lie. A stick that reports itself as storage on Monday can report itself as a keyboard on Tuesday, and antivirus scanning the files on it will find nothing, because the files are not where the problem lives.
The practical version is unglamorous. Plug the device into an unlocked, logged-in machine and it types — quickly, invisibly, and without needing to know your password, because it arrived after you had already entered it. The whole attack is over in the time it takes to look away.
The condition it needs is the important part. It needs a physical port. It needs the machine unlocked and a user already signed in. Neither of those is something an attacker can obtain remotely, and both of them are things you control completely.
The cable variant
The same logic applies to cables. A USB cable is normally a passive object, but there is room inside the moulded plug for a small controller, and cables built that way have been sold openly as penetration-testing tools for years. Visually they are indistinguishable from the real thing; by weight and feel, largely so.
This matters less for the cable you bought and more for the cable you did not: the one already plugged in at a hotel desk, the one a stranger lends you, the conference freebie. The defence is the same as for sticks — the object is untrusted, so do not connect it to something unlocked.
Juice jacking, in context
Public charging points have been the subject of official warnings for years. The US Federal Communications Commission has published advice about "juice jacking" since 2021, and the FBI has issued similar warnings. The theory is exactly the cable problem: a USB port carries both power and data, so a compromised charging point could in principle attempt a data connection rather than just supplying current.
Here is the part most coverage omits, and it is the part that makes this article worth trusting: both agencies have acknowledged that there are no publicly documented cases of this actually happening to travellers. The warning describes a genuine capability, not a recorded pattern of harm.
Two things follow. First, do not restructure your travel around it — this is not the reason your accounts get compromised. Second, the countermeasure is so cheap and so frictionless that you may as well take it anyway:
- Carry your own charger and use a wall socket. A mains adapter carries no data lines. This single habit removes the entire question.
- Use a charge-only cable or a data blocker if you must use a public USB port. Both work by simply not connecting the data pins.
- Answer the prompt correctly. Modern phones ask what a new connection is for. "Charge only" is the default you want; "trust this computer" is the one that matters, and it should be reserved for computers you own.
- Prefer a power bank. It solves the problem and the queueing problem at the same time.
What actually protects a computer
The defences that work here are unfashionable because they are settings rather than purchases.
- Automatic screen lock, on a short timer. This is the whole game. A device that types into a locked machine accomplishes nothing, and a short lock timer shrinks the window to almost nothing. If you take one thing from this article, take this one.
- Do not leave a laptop unattended and unlocked in any shared space — an office kitchen counts.
- Sign in as a standard user, not an administrator, for day-to-day work. Plenty of what an injected sequence would want to do requires an elevation prompt, and a prompt you did not initiate is a very loud signal.
- Keep endpoint protection running. It does not see the device pretending to be a keyboard, but it does see much of what such a device would try to fetch and run afterwards. If you do not already have a licence you trust, Bitdefender and Norton 360 are both reasonable mainstream choices; our do you need paid antivirus piece is the fuller argument about when free is sufficient.
- On managed or work machines, ask about USB device control. Business endpoint suites can restrict which device classes are allowed to enumerate at all, which turns this from a habit into a policy.
What about phones
Phones are in better shape than laptops here. Both major mobile platforms require an explicit decision before a newly-connected accessory gets data access, and both have hardened this repeatedly — a locked phone will generally not hand anything to a cable it has not been told to trust. Keeping the device updated is most of the work, and a passcode rather than no passcode is the rest.
Where this fits
Physical-access attacks are the smallest slice of real-world compromise, and the least likely to reach you. They are worth understanding because the fix is nearly free, and because the same instinct — this object arrived from somewhere I do not control, so I will not extend it trust — is the instinct that also stops phishing and scam texts.
For the rest of the cheap-hardware picture, start at what these gadgets can actually do. For the version of this problem that involves crossing a border with your devices, see travel device security. And if something did get in, ransomware: what to do and how to back up your data are the recovery side. The tools for both are compared in our security tool comparison.
Affiliate disclosure
This article contains affiliate links. If you purchase through them, CyberTechVault earns a commission at no extra cost to you. Our assessments are based on vendors' published documentation, independent lab results and security disclosures — not on hands-on testing by us. We earn a commission from some links on this site; it can influence which providers we feature.
Full disclosure: /affiliate-disclosure.
Sources
Factual claims above were checked against these primary sources. Verify directly on the source for anything time-sensitive before relying on it.
Continue reading
privacy
Card Cloning: Why Old Badges Copy in Seconds and Bank Cards Do Not
Why some building badges copy in seconds and others cannot: static radio identifiers versus cryptographic cards, and why your bank card is the safe one.
vpn
Evil Twin Wi-Fi: What a Fake Hotspot Can and Cannot See
An evil twin attack lets a fake access point broadcast a familiar Wi-Fi name. Discover what an attacker can see, and how encryption and VPNs help.
guides
Ransomware Protection Guide 2026: Prevent & Recover
A practical ransomware protection guide for 2026: how ransomware works, how to prevent it, the backup strategy that defeats it, and what to do if hit.
