But... can the USB firmware be rewritten from a computer? And if it can, wouldn't the fix just be to make that firmware read-only? I'm pretty sure there are ways to at least prevent this, if not actually "fix" it. I mean, considering how ubiquitous USB is, this has a chance to be pretty bad, but there are ways to safeguard at least new hardware. if I can't change permissions on my own external drives, a malicious app can't change USB firmware. And if it IS just modified USB devices that have been hacked up, it's already a little ridiculous to think that any threat could spread too far.