Can USB 3.0 device initiate communication with USB 2.0 computer?

Question

I want to copy files from a computer with USB 2.0 support to an external drive with USB 3.0 support, but do not trust that the external drive is free of malware. Can a USB 3.0 device initiate communications with a USB 2.0 computer upon connection?

I have a late 2009 iMac running Mac OS 10.8. The tech specs state USB 2.0 hardware support. Someone sent me an external drive with USB 3.0 support, but I don't necessarily trust the device is free of malware. The Wikipedia page for USB states that USB 3.0 introduced support for device-initiated communication (i.e. an external device connected to a computer via USB 3.0 can start sending commands over the wire without waiting for any request from the computer).

I realize I'm being a little paranoid, but the question is also motivated by curiosity. Thanks for any feedback!

Answer 1

For copying files / mounting USB drives you are usually safe, unless there is a specific vulnerabilities in your USB drivers (see http://www.vulnerabilityassessment.co.uk/education/whitepaper.pdf for the USB exploit that StuxNet used).

Be aware though, that what seems to be simple drive, might in fact be a device like the USB Rubber Ducky, which registers as a HID (Keyboard) to the PC, and upon connection performs a set of predefined keystrokes.

Answer 2

Copying files to an external drive does not infect the PC and this is regardless of communication method (USB, firewire, eSATA, etc...). USB 3.0 is at it's core a faster version of USB 2.0 (with some better power specs).

If a USB firmware (which is most likely in ROM and not editable) were compromised from the vendor it might be possible to install virus when a device was connected. This would be regardless of whether the device initiated the communication or the PC. The likely hood of this type of attack would be very rare.

Usually only opening files on the external drive could potentially infect the host PC.