See the recent BadUSB attack [1][2] for how this sort of attack can work; the firmware of the USB microcontroller itself can be infected.<p>[1] <a href="https:&#x2F;&#x2F;srlabs.de&#x2F;badusb&#x2F;" rel="nofollow">https:&#x2F;&#x2F;srlabs.de&#x2F;badusb&#x2F;</a>
[2] <a href="http:&#x2F;&#x2F;www.wired.com&#x2F;2014&#x2F;07&#x2F;usb-security&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.wired.com&#x2F;2014&#x2F;07&#x2F;usb-security&#x2F;</a>