We all know the story of the USB drive left outside a power plant which was found by a worker and inserted into a computer to see the contents which then allowed a hack to ensue.

Here is my question, how? I get that code is executed but how? I would really like to be able to do this (for my own curiosity of course). I have always had a good grasp on security how to make things secure etc etc but things like viruses, trojans, USB drivers... how are they activated with little human interaction?

I would really like to learn about these things, I am a programmer/sys admin so would like to knock up a script but having never been taught or never have done it I don't know how or where to begin. I would really like a big discussion on this with as much information as possible.

Take a look at this USB keyboard:



"But that's not a keyboard! That's an USB drive, silly!"

Actually, no.  It looks like a USB drive to you, but when it gets connected to a computer, it will report that it is a USB keyboard.  And the moment it is installed, it will start typing key sequences you programmed on it beforehand.  Any operating system I know automatically trusts USB keyboards and installs them as trusted input devices without requiring any user interaction the moment they are connected.

There are various payloads available for it. For example, there is one which types the keyboard input to open a shell, launches WGET to download a binary from the Internet, and runs it.
