You don't even need to do that. The USB key can just announce to the computer "Hi I'm a USB hub. I have a keyboard and a USB flash drive plugged into me."
What stops the OS implementing something that says "until you prove you're a keyboard, you can't type anything"? Something like the authorisation screen for Bluetooth keyboards.
"Your granddaughter Red Riding Hood is at the door, miss, and is definitely not a wolf."
"Do not let her in."
"I definitely did not already did, miss."
I can see how the current state of affairs is insecure, but I'm confused by the 'unpatchable' claim. I truly am clueless in this area, but initially it seems hyperbolic to say that the only way to fix this is to replace all USB controllers in existence.
That's just for USB keyboards though, there used to be these USB sticks that pretended to be a CD-rom drives in the windows xp days where those were autorun, I'm sure there's other vulnerabilities that can be exposed through USB nowadays.
1. User plugs in USB drive and keyboard. 2. USB drive obtains the ID of the keyboard. 3. Later, it looks when the keyboard is not plugged in and changes it's ID to that of the keyboard. 4. Now the computer thinks when the USB drive is an authorised keyboard, and can type whatever malicious commands it wants.
Is that right? Apart from keyboard, what other devices could it exploit?
To extend my (now hilariously) tortured analogy, granny is stuck in bed, she can't check if it's a wolf until the butler knows there's someone at the door. As soon as he sees the wolf, he is compromised. Maybe a vampire would have been a better metaphor?
[EDIT] actually I should dump the analogies altogether: this is a hardware vulnerability, not software. It hits the computer, the operating system is helpless. That’s why the problem, for existing computers, is not apparently fixable.