Establishing the the provenance of USB devices is going to be hard. People are going to continue to use USB keys for the sneakernet. Infection rates are going to be high. This has the potential to be pretty impactful to everyday people in a way that, say, shellshock is mostly not.

I wonder how long it will take for someone to come up with an inline hardware dongle that tries to mitigate / block this.