So it was just a dummy usb hid device that emulates a keyboard. No exploit or anything but a simple marketing gimmick that people take because of 'hey, a free usb stick!'.
Here's some more info: http://blog.opensecurityresearch.com/2012/10/hacking-usb-web...
Or it could emulate a disk + HID keyboard, and enter the win+r filename.exe <RET> keystrokes necessary to launch it, or one of several other tricks.
It could also intercept mass storage requests, wait til you're copying an exe onto there (even if you've reformatted the drive since), and inject a payload into it.
This one does actual work as a legit USB stick too once you get past the annoying link part.
They are not doing this secretly, consumed by fear and guilt, manufacturing these devices in the backroom of some disreputable bar in the nasty part of town and then furtively selling them from a van in a back alley, living in constant dread of exposure. They do this quite openly. They manufacture these things in many of the same boring factories that make the reputable brands. If you ask them, they'll cheerfully mail you some free glossy promotional material detailing fake USB drives and many other nefarious electronic things that they'll sell to anyone with a credit card, and your order will be delivered to your doorstep quite openly via FedEx or DHL.
They don't care (at all, on any level) what we or anyone else think about the moral propriety of their operation, surprising though that fact may be. Indeed, a public shaming campaign would benefit them greatly as free advertising, by bringing their very existence to the attention of many new customers.
I didn't mean to shame manufacturers. They have plausible deniability anyway - "it's a keyboard emulator that looks like a pendrive!". I think that companies that buy these devices and use them for marketing on trade shows should be shamed and blamed.
Of course there should be a room for caution and thought. Maybe this exec and his company really weren't aware of the implications of what they were doing. Nevertheless, there needs to be back pressure. In this case giving feedback may be enough - I'm in favour of being as nice to people by default - but in others such methods should be denounced.
No worries - didn't come across wrong. Personally I was a little miffed about scoring a snazzy SD USB adapter...that turned out to be "crippled"...but hey...gift.
>Nevertheless, there needs to be back pressure.
Thats tricky - firstly I can't jeopardize a big contract by complaining about a trivial gift (!). Secondly the company in question is "truly" innocent / oblivious here. They get a marketing catalog and pick 100 of item X. Not sure how one would reach such a marketing company - but they are the culprits here.
I understand. It would be awesome if the word reached that company that the item they picked from catalog is both evil and moderately annoying to users. They actually might take it into account (people often do care if they know; I've personally made a SEO spammer lose business like that). But it's completely understandable you might not be in position to deliver such a message. On the other hand yes, that marketing company should be one to get the blame.