USB doesn't have implicit DMA (Direct Memory Access), so it can't install malware on your computer without getting past your operating system. (Though just enabling autoplay will do the trick - and I have no idea whether thats turned on by default these days.)

Firewire used to have DMA access via how the port was physically wired, but afaik it was fixed before being phased out. Thunderbolt also gets access to the PCIe bus (and also by extension, DMA). I'm not sure what the security situation is there.

As others have mentioned, USB devices can also do physical damage to your computer if they want to, by charging a capacitor over a few seconds then discharging it all at once.

Its generally a bad idea to plug mystery USB devices into your computer.

> Thunderbolt also gets access to the PCIe bus (and also by extension, DMA). I'm not sure what the security situation is there.

There is support for having the user authorize the device before logically connecting it to the rest of the system; see e.g. https://wiki.archlinux.org/title/Thunderbolt#User_device_aut...

It would not surprise me if this does nothing, because firmware implements it poorly, and/or because users click OK on everything.

Device authorization for PCIe tunnels is TB3+ feature, older versions are out of luck.

The situation with firmware is not that bad, though. There are exactly two of them, Intel and Apple. Apple devices have the Apple implementation and the rest of the world Intels.

On capable hardware, IOMMU is also used (for all security levels).