How to Check USB Devices for Unsafe Firmware

USB devices can contain firmware that controls how they identify themselves and behave, and a compromised or poorly designed device may do more than store files. You can reduce risk by checking its identity, looking for unexpected behavior, using reputable update tools, and scanning files—but ordinary antivirus software cannot certify that firmware is safe. These steps are useful for USB drives, hubs, keyboards, and other peripherals; they cannot prove a device is free of malicious firmware.

What You’ll Need

A computer with current security updates and antivirus or endpoint protection enabled.
The device, its packaging or manufacturer details, and a known-good cable if applicable.
Administrator access if you need to install an official firmware updater.
For higher-risk checks, a spare computer that contains no sensitive accounts or files. Keep it offline until you know what the device does.

Step-by-Step

Decide whether the device is trustworthy enough to connect. If it was found, received unexpectedly, bought from an unknown seller, or left unattended, do not plug it into a computer containing sensitive data. A USB device can present itself as a keyboard or network adapter, not just as storage. If you cannot establish where it came from, the safest choice is not to use it.
Inspect it before connecting. Look for damage, unusual seams, loose parts, unexpected adapters, or a product label that does not match its packaging. Compare its model and markings with information from the manufacturer. Appearance alone cannot rule out tampering, but obvious discrepancies are a reason to stop.
Check the manufacturer and model independently. Find the manufacturer’s support page by typing its known web address or searching for the company—not by following an unfamiliar QR code or link on the device. Confirm that the model exists, identify its intended functions, and check for security notices or firmware updates. Be cautious if the seller’s description conflicts with the manufacturer’s specifications.
Use a low-risk computer for initial identification. If you need to inspect an unfamiliar device, use a spare, updated computer with no sensitive information, ideally disconnected from the network. Do not use a work computer unless your IT team approves. Connect only the device you are examining, and do not open files or run software it presents. If no isolated computer is available, skip this test rather than risk your main system.
Observe what the operating system detects. Check the system’s device list or hardware information screen and note the device name, type, manufacturer, and model identifiers if shown. On Windows, Device Manager lists connected hardware; on macOS, System Information shows USB devices; on Linux, the desktop’s hardware settings or standard device-information tools may show them. Compare what appears with the device’s documented function. A storage stick should not unexpectedly appear as a keyboard or network adapter. However, legitimate multifunction devices can expose several interfaces, so verify them with the manufacturer before drawing conclusions.
Watch for unexpected behavior. Disconnect immediately if the device starts typing, opens windows, changes network settings, repeatedly disconnects, or prompts you to install unknown software. Do not click unexpected prompts or approve administrator access. A brief detection sound or a request to format an unreadable drive is not proof of malware, but do not format it if you need its data or do not trust its origin.
Scan files without executing them. For a storage device you have a good reason to use, let your operating system’s security software scan it before opening files. Keep automatic protection and definitions up to date. Do not run programs, scripts, shortcuts, or installers from the device merely because a scan finds nothing. A clean file scan checks accessible files; it does not inspect or certify every device’s firmware.
Update firmware only through a verified channel. If the manufacturer provides an update for the exact model, read its instructions and release notes. Download the updater from the manufacturer’s official support site, verify the model and compatibility, and follow the stated power and connection requirements. Do not interrupt an update. Never install firmware supplied by an unknown seller, third-party download site, or pop-up. Some devices have no user-accessible firmware update or verification method.
Use the device cautiously after checks. Eject storage safely, disconnect it when not needed, and avoid using unknown devices on computers that handle important accounts or data. If it remains suspicious, stop using it and contact the manufacturer or your organization’s security team. For a workplace device, preserve its packaging and details and follow internal reporting instructions rather than experimenting with it.

Common Mistakes

Treating a clean antivirus result as proof. Antivirus tools primarily examine files and behavior they can observe. They may not detect compromised firmware or a device that pretends to be another type of hardware.
Opening files to see what they are. Filenames and icons can be misleading. Do not execute unknown files, enable macros, or approve an installer simply to investigate the device.
Assuming every extra interface means an attack. Some legitimate peripherals combine storage, audio, networking, or input functions. Compare the detected interfaces with the product documentation before deciding.
Using a supposedly safe test computer without preparing it. A spare computer that is logged into personal accounts or connected to shared drives may still be exposed. Keep it updated, remove sensitive access, and disconnect it from networks for initial inspection where practical.
Installing a firmware updater from a search ad or download mirror. Use the manufacturer’s support page and verify that the update is for the exact model and revision.

Tips

Keep a record of the device’s source, model, serial number, and the date you first connected it. This helps identify unexpected changes later.
For removable storage, disable automatic opening or execution of content where your operating system offers that setting, and keep the system patched.
Use a data-blocking USB adapter only when you need charging and do not need data transfer. It can limit data connections in suitable situations, but it is not a firmware scanner and may not work for every device.
For organizations, let IT or security staff assess unknown peripherals. They can use managed equipment and procedures that are not available on a typical home computer.

Troubleshooting

The device is not recognized: Try a known-good cable or port only if the device is trusted, and check the operating system’s device list. Avoid repeatedly reconnecting a suspicious device. Recognition failure does not establish that firmware is safe or unsafe.
The displayed name or type seems wrong: Record the exact details and compare them with the manufacturer’s documentation. Check whether the product supports multiple functions. If the mismatch remains unexplained, disconnect it and ask the manufacturer or IT support.
An update tool rejects the device: Stop rather than forcing an update. Confirm the model, hardware revision, operating system, and updater source. Contact the manufacturer if its instructions do not resolve the mismatch.
A scan reports a threat: Do not open the device’s files. Follow your security software’s quarantine or removal guidance, disconnect the device, and seek professional help if the computer shows signs of compromise. On a managed computer, notify IT immediately.
The device behaves strangely after connection: Disconnect it. If it may have typed commands or changed settings, stop using the computer for sensitive activity and contact your security team or a trusted technician. Do not assume unplugging reverses changes already made.

Frequently Asked Questions

Can I scan USB firmware with antivirus?
Usually not in a conclusive way. Antivirus can scan accessible files and may detect some suspicious behavior, but it cannot certify that a device’s firmware is genuine or uncompromised.

Can a USB device infect a computer without opening a file?
Yes. A device may identify itself as an input or other hardware type, or exploit a software vulnerability. Keeping systems updated and avoiding untrusted devices reduces risk but cannot make an unknown device safe.

Is an unfamiliar device name proof of malware?
No. Names can be generic, incomplete, or different from the retail product name. Compare its hardware identifiers and functions with manufacturer documentation; disconnect it if you cannot explain the mismatch.

Should I format a suspicious USB drive?
Formatting removes or changes data on the drive but does not reliably remove malicious firmware. Do not format it if you need evidence or files. If its source is untrusted, stop using it.

How can I verify that a firmware update is authentic?
Get it from the manufacturer’s official support site, match the exact model and revision, and follow the manufacturer’s verification instructions if provided. If no authenticity check is offered, you cannot independently treat the update as verified.

What should I do with a USB device I do not trust?
Do not connect it to a computer you care about. Ask the manufacturer or your organization’s security team for guidance, or dispose of it through an appropriate electronics recycling route.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →