USB FLASH DRIVES

Small USB flash drives (aka pen drives, aka USB sticks) can be surprisingly dangerous, both their software and their hardware.

SOFTWARE

Most defensive issues involve their software and this has a very simple solution: any new USB flash drive, whether purchased at retail or found lying on the floor, should be plugged in to a Chromebook running in Guest Mode. If the drive has malicious software, it should not infect the Chromebook (most malware targets Windows or macOS), and if it does infect something, exiting Guest Mode should wipe out the infection.

Better still, format the drive from the Chromebook to hopefully wipe out any possibly hidden software or files.

HARDWARE

On the hardware side, the articles below show that a USB flash drive can both explode (when a person is the target of bad guys) or destroy the computer it connects with.

The first I had heard about exploding USB flash drives was in March 2023 as detailed in the articles below. As soon as the flash drive got power from the USB port in a computer, it exploded.

• Journalist hurt by exploding USB bomb drive by Thomas Claburn for The Register. March 22, 2023
• Journalist plugs in unknown USB drive mailed to him - it exploded in his face by Scharon Harding for Ars Technica. March 22, 2023

The defense here is a USB extension cord, preferably 6 feet or longer. Plug the cord into the flash drive and then stand far away from the flash drive when you plug the other end of the extension cord into a computer. Maybe even have a barrier between the flash drive and yourself. This is yet another reason to use a Chromebook for USB flash drives as they are, generally, cheaper than other computers. Then too, the below.

• 'USB Killer' flash drive can fry your computer's innards in seconds by Dan Goodin for Ars Technica. October 14, 2015. Booby-trapped USB stick delivers 220-volt charge to attached computer.

Other than avoiding anything but a brand new flash drive, the defense here, yet again, is a Chromebook. This time a very cheap one to serve as the sacrificial lamb, so to speak.

I first heard of the Malicious Cable Detector by O.MG in August 2023. It claims to detect all types of malicious USB cables. At the time, it sold for $40.