[depressed]

Shouldn't preventing this be as easy as turning off autorun? In fact, I thought Windows had that off by default for USB devices.

(Of course, I'm assuming we're not dealing with a zero-day in the USB stack or filesystem drivers. But that probably is something that the Secret Service should be on top of, as well.)

[analog31]

Good question. As I understand it, the USB stick can present itself as a keyboard, which is automatically mounted, and begins entering a series of keystrokes that program the system to compromise itself.

In essence, modern OS's give "autorun" privilege to keyboards and mice. That's the HID in this discussion -- Human Interface Device.

[depressed]

Aha, I missed that piece of the puzzle. Thank you.

[darkarmani]

> this be as easy as turning off autorun

What does autorun have to do with a mouse or keyboard device? The problem with USB is that you don't know if it is a "mass storage device" or any of the other kinds of devices that can start interfacing with your computer.

If it is an (automated) keyboard device (HID), it will immediately start "typing" which means it can open a terminal window and start executing things.