The USB Stick That Types: BadUSB, Bad Cables and Juice Jacking

By NorwegianSpark Editorial · Published August 9, 2026 — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.

There is one design decision at the root of this entire class of attack, and it was made long before anyone thought of it as a security question. When you plug something into a USB port, the device tells the computer what it is. The computer believes it. There is no certificate, no challenge, no proof — the device simply declares "I am a keyboard" and is treated as one from that moment on.

That is not a bug anybody can patch, because it is what makes USB usable. It is also why a device shaped like a memory stick can behave like a very fast typist.

What the attack actually is

Researchers Karsten Nohl, Sascha Krißler and Jakob Lell presented this publicly at Black Hat in 2014 under the name BadUSB. Their point was broader than one trick: the firmware on ordinary USB controllers can be rewritten, so a device's *identity* is software, and software can lie. A stick that reports itself as storage on Monday can report itself as a keyboard on Tuesday, and antivirus scanning the files on it will find nothing, because the files are not where the problem lives.

The practical version is unglamorous. Plug the device into an unlocked, logged-in machine and it types — quickly, invisibly, and without needing to know your password, because it arrived after you had already entered it. The whole attack is over in the time it takes to look away.

The condition it needs is the important part. It needs a physical port. It needs the machine unlocked and a user already signed in. Neither of those is something an attacker can obtain remotely, and both of them are things you control completely.

The cable variant

The same logic applies to cables. A USB cable is normally a passive object, but there is room inside the moulded plug for a small controller, and cables built that way have been sold openly as penetration-testing tools for years. Visually they are indistinguishable from the real thing; by weight and feel, largely so.

This matters less for the cable you bought and more for the cable you did not: the one already plugged in at a hotel desk, the one a stranger lends you, the conference freebie. The defence is the same as for sticks — the object is untrusted, so do not connect it to something unlocked.

Juice jacking, honestly

Public charging points have been the subject of official warnings for years. The US Federal Communications Commission has published advice about "juice jacking" since 2021, and the FBI has issued similar warnings. The theory is exactly the cable problem: a USB port carries both power and data, so a compromised charging point could in principle attempt a data connection rather than just supplying current.

Here is the part most coverage omits, and it is the part that makes this article worth trusting: both agencies have acknowledged that there are no publicly documented cases of this actually happening to travellers. The warning describes a genuine capability, not a recorded pattern of harm.

Two things follow. First, do not restructure your travel around it — this is not the reason your accounts get compromised. Second, the countermeasure is so cheap and so frictionless that you may as well take it anyway:

• Carry your own charger and use a wall socket. A mains adapter carries no data lines. This single habit removes the entire question.
• Use a charge-only cable or a data blocker if you must use a public USB port. Both work by simply not connecting the data pins.
• Answer the prompt correctly. Modern phones ask what a new connection is for. "Charge only" is the default you want; "trust this computer" is the one that matters, and it should be reserved for computers you own.
• Prefer a power bank. It solves the problem and the queueing problem at the same time.

What actually protects a computer

The defences that work here are unfashionable because they are settings rather than purchases.

• Automatic screen lock, on a short timer. This is the whole game. A device that types into a locked machine accomplishes nothing, and a short lock timer shrinks the window to almost nothing. If you take one thing from this article, take this one.
• Do not leave a laptop unattended and unlocked in any shared space — an office kitchen counts.
• Sign in as a standard user, not an administrator, for day-to-day work. Plenty of what an injected sequence would want to do requires an elevation prompt, and a prompt you did not initiate is a very loud signal.
• Keep endpoint protection running. It does not see the device pretending to be a keyboard, but it does see much of what such a device would try to fetch and run afterwards. If you do not already have a licence you trust, Bitdefender and Norton 360 are both reasonable mainstream choices; our do you need paid antivirus piece is the fuller argument about when free is sufficient.
• On managed or work machines, ask about USB device control. Business endpoint suites can restrict which device classes are allowed to enumerate at all, which turns this from a habit into a policy.

What about phones

Phones are in better shape than laptops here. Both major mobile platforms require an explicit decision before a newly-connected accessory gets data access, and both have hardened this repeatedly — a locked phone will generally not hand anything to a cable it has not been told to trust. Keeping the device updated is most of the work, and a passcode rather than no passcode is the rest.

Where this fits

Physical-access attacks are the smallest slice of real-world compromise, and the least likely to reach you. They are worth understanding because the fix is nearly free, and because the same instinct — *this object arrived from somewhere I do not control, so I will not extend it trust* — is the instinct that also stops phishing and scam texts.

For the rest of the cheap-hardware picture, start at what these gadgets can actually do. For the version of this problem that involves crossing a border with your devices, see travel device security. And if something did get in, ransomware: what to do and how to back up your data are the recovery side.