I read a BBC article about empty USB sticks containing malware:


  Berlin-based researchers Karsten Nohl and Jakob Lell said a device
  that appeared to be completely empty could still contain a virus.



How can "empty" USB sticks contain malware?
Is this only a problem for (legacy) Windows systems? 
Is there some way to use these sticks while protecting yourself?



This question may seem similar to other questions  but those have not concerned empty sticks.

You can hack the firmware of a USB device. With that you can tell the OS whatever you want, eg. the device is empty even it is not. Or attack the USB software stack of the OS by sending data that a normal USB device would not send (so the device could even really be empty, the attack comes from the firmware).

You can also do other funny stuff, like tell the OS that the USB device is also a keyboard, then automatically type commands that do something if it is plugged in. Or tell the OS the USB device is a network card, and redirect all traffic to a server you control.

Endless fun with hacked USB firmwares...
