USB Killer

Someone joked that this would be useful to ensure people won&#x27;t randomly plug USB drives into their computers. Sounds insane, except that...<p>&quot;During a stop-over in Hong Kong, he finds a spare USB key in his hotel room. Curious, he inserts it into his laptop. By the time he arrives in Australia, his computer is infected.&quot;[1]<p>This was the one of the infection vectors for a large flare-up between the Chinese government and a number of Australian based mining companies, all well before the Snowden leaks that have only made the world more complex.<p>Given the choice between frying an employee&#x27;s USB &#x2F; computer (small monetary loss) and allowing trade secrets to fall into the hands of competitors &#x2F; customers (large monetary loss), it&#x27;s not crazy to opt for the former.<p>Standard practice has even gone further. A colleague of mine purchases fresh laptops for when he goes overseas and then never uses them again. He doesn&#x27;t even work in an industry where commercial secrets are common. I&#x27;d hope that anywhere that features security implications or commercial secrets would also act at this level.<p>Perhaps an innocuous version of this, which starts a high pitch whistle, would be useful in a corporate environment. Less destructive but resulting in the the same security awareness.<p>[1]: <a href="http://www.abc.net.au/4corners/special_eds/20100419/cyber/" rel="nofollow">http:&#x2F;&#x2F;www.abc.net.au&#x2F;4corners&#x2F;special_eds&#x2F;20100419&#x2F;cyber&#x2F;</a>

Best comment from the page: &quot;It needs to have en eInk display to say 128, 129&quot;<p>Such yes.<p>...<p>I was walking past a tall wooden fence the other day, you know the kind you see outside a building site. As I walked along beside it I heard chanting coming from behind the fence further up... they were chanting numbers, or rather just one number. &quot;Thirteen, thirteen, thirteen, thirteen, ...&quot; they excitedly chanted. It sounded like a small crowd, young and old; men, women and children. All of them saying the same number over and over. As I approached I saw a small hole in the fence just big enough to look through. The hole was right where the sound appeared to be originating from. So, with the crowd continuing to chant &quot;... thirteen, thirteen, thirteen, thirteen&quot; and it seeming to become more intense as I leaned down to place my eye at the hole and work out WTF was happening in there. Just as I put my eye to the hole a small finger like that of a child poked me in the eye and the crowd stared cheered loudly and started chanting again.. &quot;Fourteen, fourteen, fourteen...&quot;

It would be cool to create a version of this that just sounded a really, really loud siren. Then you could leave it lying around the office, and listen out for the bunnies.

I tried to do one better with a small flyback transformer.<p><a href="https://gfycat.com/GlaringGrimCondor" rel="nofollow">https:&#x2F;&#x2F;gfycat.com&#x2F;GlaringGrimCondor</a><p>Turns out there&#x27;s not enough clearance in USB ports for tens of thousands of volts.

Reminds me of a story I heard many years ago. UK power plugs have three prongs to include earth. If you rewire earth, live and neutral AND alter the plug wall socket to match, then all is well, but if someone steals your PC then plugs it in using a standard wall socket then ouch.

I once encountered a computer that was the opposite of this; plug any USB device into it, and the device would never work again, even in another computer.

This reminds me of the Etherkiller page (sending 120 volt to various devices: NICs, HDDs...): <a href="http://www.fiftythree.org/etherkiller/" rel="nofollow">http:&#x2F;&#x2F;www.fiftythree.org&#x2F;etherkiller&#x2F;</a>

Reminds me of one my favorite &quot;Bastard Operator From Hell&quot; stories: <a href="http://www.chinet.com/html/bofh/tradeshow.html" rel="nofollow">http:&#x2F;&#x2F;www.chinet.com&#x2F;html&#x2F;bofh&#x2F;tradeshow.html</a><p>Turns out this is a very old idea. :-)

If you&#x27;re feeling ornery,you could fly with one in your hand luggage.<p>If the TSA or foreign equivalent border security want to scan your devices, it&#x27;s their look-out.

The worst suggestion in the world: make one of these look like one of those USB dead-drops.

I bet you could get a few thousand of these made for like 10 grand? I&#x27;m glad people who just want to cause mayhem aren&#x27;t competent.

Here are parts to design into your USB device to prevent that.<p><a href="http://www.mouser.com/applications/usb30_circuit_protection/" rel="nofollow">http:&#x2F;&#x2F;www.mouser.com&#x2F;applications&#x2F;usb30_circuit_protection&#x2F;</a><p><a href="http://www.te.com/content/dam/te/global/english/products/Circuit-Protection/knowledge-center/documents/an-coordinated-circuit-protection-usb.pdf" rel="nofollow">http:&#x2F;&#x2F;www.te.com&#x2F;content&#x2F;dam&#x2F;te&#x2F;global&#x2F;english&#x2F;products&#x2F;Cir...</a>

Evil.<p>I&#x27;ve often wondered what percentage of those dirt-cheap UBS devices sold on eBay are actually trojan horses. Provide a basic functional USB hub at a cut-rate price, but exploit the access to your customer&#x27;s PC for nefarious purposes. Seems like an easy crime to perpetrate.

This is just one of many reasons why you should not ever stick unknown things in your healthy ports (or your healthy things in unknown ports). Not without protection. Safety first. But I&#x27;m a firm believer that people should be able to consent to this kind of behavior if they really wish to.

One could give these out to activists around the world, they seem to be always at risk of getting their electronic devices confiscated by law enforcement.

If you use a USB hub, would both it and your computer get cooked, or just the USB hub?

Last year, I found a usb key on the ground, almost busted, still I&#x27;m too curious to know what&#x27;s in it so I bring it home. Plug it in, then I learn a little more about the USB protocol as the kernel notifies me there&#x27;s an &quot;Over-current condition on port 3&quot;, just before a tiny bit of smoke emerges from the key.

I would like to see this device on kickstarter :)

It&#x27;s a USB blotto box: <a href="http://cd.textfiles.com/group42/ANARCHY/COOKBOOK/BLOTBOX.HTM" rel="nofollow">http:&#x2F;&#x2F;cd.textfiles.com&#x2F;group42&#x2F;ANARCHY&#x2F;COOKBOOK&#x2F;BLOTBOX.HTM</a><p>The old school version required a portable generator. Miniaturization at its finest!

The potential damage this implies is ridiculous.<p>Looks like I&#x27;m stocking up on Raspberry Pi-s to deal with my curiosity from now on...

This is so not cool.

I would like a version that has small GPS receiver and can sends SMS with location information when plugged in. It should works otherwise just like normal USB. (could be the size of USB HDD for example).

Well at least the new MacBook won&#x27;t have a problem with this device.

I made a list of other way usb can be evil: <a href="http://www.jefftk.com/p/malicious-usb-sticks" rel="nofollow">http:&#x2F;&#x2F;www.jefftk.com&#x2F;p&#x2F;malicious-usb-sticks</a>

Build this into a DeadDrop (seen on HN yesterday) for added fun.

I believe the original is the Etherkiller:<p><a href="http://www.fiftythree.org/etherkiller/" rel="nofollow">http:&#x2F;&#x2F;www.fiftythree.org&#x2F;etherkiller&#x2F;</a>

I understand the concept of the article, a USB device that will fry your laptop by charging and applying high voltage.<p>But I don&#x27;t understand the excerpt about the guy writing number 129 on a USB stick and stuff. Why would he plug it in his laptop if he knew it would burn it? And if it was intential, aren&#x27;t there easier ways to burn it? Thanks for explaining...

This immediately reminded me of the slightly infamous and almost certainly apocryphal &quot;box&quot; of the phreaking era for supposedly overloading and destroying your adversary&#x27;s phone, or even taking down the local POTS switch. It was called a urine box most commonly, or sometimes a copper box or assassin box if I recall correctly.

what about making it a normal usb drive as well. let me explain: when one inserts the drive, one gets asked for a password. if you type the wrong password, the usb drive shows you some fake content, and in the background “burns down” everything it can. if you are the owner and type the right password, you can use the usb drive normally

This is pure evil! (not in a good way)

Pretty cool (and scary!) modern day version of the old anarchist cookbook diskette bombs.

Is there any chance this could be dangerous to the human and not just his device?

I thought I remembered reading something about quite a high profile hack that was carried by infecting computers by people using USB sticks that were strategically left on the floor of a parking lot near their car.

.. worst written article ever

Going to such extend to add a feature to USB which FireWire has built-in. :p

If any USB mouse, USB keyboard or soon also USB charger is a potential laptop annihilator, then maybe it&#x27;s something wrong with the USB standard.

What if the voltage kills someone? Is it not too dangerous?<p>Lesson is not to use&#x2F;touch the USB stuffs not belongs to you. Good moral story for 2nd grader.

Ouch. Not a traditional attack one would expect on a USB port. Would be there any practical protection against this (surge protector, fuse)?

Do you think he&#x27;s tested it?