Adam Savage Explains Malicious USB Device Attacks

The Thumb Drive That Thinks It's a Keyboard

Here is the part that should genuinely bother you. Your computer does not see a USB device as a storage stick or a cable. It sees whatever that device tells it to be. A malicious USB device built on hardware like the USB Rubber Ducky can announce itself to your operating system as a keyboard, and the moment it does that, every USB-blocking policy your IT department wrote becomes irrelevant. Keyboards are trusted by default. They have to be. So the device starts typing, invisibly, at machine speed, and your computer executes every command without a second thought. The human at the desk never touches a key.

More Processing Power Than the Moon Landing, Sitting in Your Parking Lot

The experts on Why Adam Savage Won't Trust USB Keys on Adam Savage's Tested make a point that reframes the whole problem: the computing power inside a modern USB key dwarfs what guided Apollo to the lunar surface. That is not a metaphor about progress. It is a direct statement about threat surface. A device small enough to lose in a couch cushion can run a full Linux operating system, maintain persistent scripts, and phone home to an attacker continuously. The implication is that any intuition you have about how dangerous a small device can be is almost certainly wrong.

Keystroke Logging Is the Entry-Level Version and That Should Tell You Something

Before we get to the sophisticated attacks, there is a simpler one worth understanding. A basic malicious USB device can log every keystroke on the machine it is connected to, capturing passwords and sensitive inputs in real time. The attacker needs physical access twice: once to install it, once to retrieve it. That is the floor. The ceiling, as the Tested episode demonstrates, is a device that installs a persistent script taking continuous screenshots and uploading them to a cloud service without triggering security software. The entry-level attack already captures your banking password. The advanced version watches everything you do, indefinitely. Supply chain attacks follow a similar escalation logic, as we covered in our breakdown of the

Our Analysis— Tyler Hoekstra, Technology reporter covering AI, software, hardware, and the companies shaping the digital future

Our Analysis: The scariest part of this video isn't the hacking. It's how mundane the entry point is. A USB key someone finds in a parking lot. A charging cable a stranger offers at an airport. The attack surface isn't your firewall, it's your politeness.

Savage gets the behavior right but undersells how few people will actually change. Knowing something is dangerous and treating it as dangerous are very different habits. Most people won't rewire their instincts over a YouTube video.

The AirPods exploit mention deserved more airtime. Bluetooth is the new USB and almost nobody is thinking about it that way yet.

There is also a structural problem the video gestures at without fully confronting: Zero Trust security is an institutional solution, but the majority of people encountering these attacks are individuals with no IT department backing them up. A small business owner, a freelancer, a creator like Savage himself fielding drives from fans — none of them have the infrastructure to implement Zero Trust in any meaningful way. The advice is correct for enterprises. For everyone else, it lands like telling someone to build a moat around their apartment. What that population actually needs is simpler, more portable guidance: never plug in hardware you didn't buy, treat found devices as you would treat found food, and assume that anything offered to you unsolicited is optimized for the giver's benefit, not yours.

It is also worth noting that the threat model here is not theoretical. USB-based attacks have been documented in industrial sabotage, corporate espionage, and targeted harassment campaigns. The Stuxnet worm, which damaged Iranian nuclear centrifuges, is believed to have entered its target network via infected USB drives. That is the extreme end of the spectrum, but it illustrates that the architecture of the attack is identical whether the goal is stealing a password or disrupting a nation-state's infrastructure. The device doesn't know the difference. Neither does your operating system.

The most honest takeaway from the Tested episode is that physical security and digital security are the same problem, and most people have been trained to think of them separately. That mental partition is the real vulnerability.

Frequently Asked Questions

Can malware be spread through USB drives?

Yes, and the methods go well beyond hiding a malicious file for you to click. The more dangerous category of malicious USB device attacks doesn't rely on you doing anything at all — a device like the USB Rubber Ducky impersonates a keyboard, so the operating system executes its commands automatically the moment it's plugged in. No file download, no user error, no warning prompt.

What is a common example of a USB attack?

Keystroke logging is the entry-level version: a device records every key you press, capturing passwords and sensitive data, and the attacker retrieves it later with physical access. The Tested episode frames this as the floor, not the ceiling — more advanced attacks use PowerShell scripts to take continuous screenshots and silently upload them to cloud storage without triggering security software.

How do malicious USB devices bypass security systems?

The core exploit is device impersonation: a malicious USB device announces itself to the OS as a trusted peripheral, most effectively a keyboard, which bypasses USB-blocking policies entirely because keyboards must be trusted by default. This is why IT-level USB restrictions offer less protection than most people assume — they're written to block storage devices, not input devices. Zero Trust architecture, which treats every device and action as potentially compromised, is currently the most credible defense against this class of attack.

How do you check if a USB drive has malware on it?

Standard antivirus scanning can catch malicious files stored on a drive, but it won't detect a device that has no files at all — one that simply emulates a keyboard and executes commands directly. For that threat category, there's no reliable consumer-level check, which is precisely the point the Tested episode makes: the safe answer is not to plug in unknown drives rather than to scan them and feel confident.

Does a USB drive really have as much computing power as the Apollo guidance computer?

The Apollo Guidance Computer operated at roughly 0.043 MHz with 4KB of RAM, so the comparison is technically accurate — a modern microcontroller inside a USB key vastly exceeds those specs. That said, the claim is made for rhetorical impact, and we'd note it's a common framing in cybersecurity education rather than a precise engineering benchmark. The underlying security point it supports is sound: small, cheap hardware is capable enough to run a full Linux OS and persistent attack scripts. (Note: the specific computing comparison is accurate but simplified for effect.)

Based on viewer questions and search trends. These answers reflect our editorial analysis. We may be wrong.

✓ Editorially reviewed & refined — This article was revised to meet our editorial standards.

Source: Based on a video by Adam Savage's Tested — Watch original video

This article was created by NoTime2Watch's editorial team using AI-assisted research. All content includes substantial original analysis and is reviewed for accuracy before publication.

Apr 24

Is Smartphone Camera Computational Photography Hitting Its Limit?

Apr 15

AI safety alignment risks Anthropic's Mythos AI

Apr 11

NVIDIA DreamDojo Robot Learning AI: Bridging Sim-to-Real Gap

Apr 1

Adam Savage Explains Malicious USB Device Attacks

Key Takeaways