[Dark Purple] recently heard a story about how someone stole a flash drive from a passenger on the subway. The thief plugged the flash drive into his computer and discovered that instead of containing any valuable data, it completely fried his computer. The fake flash drive apparently contained circuitry designed to break whatever computer it was plugged into. Since the concept sounded pretty amazing, [Dark Purple] set out to make his own computer-frying USB drive.
While any electrical port on a computer is a great entry point for potentially hazardous signals, USB is pretty well protected. If you short power and ground together, the port simply shuts off. Pass through a few kV of static electricity and TVS diodes safely shunt the power. Feed in an RF signal and the inline filtering beads dissipate most of the energy.
To get around or break through these protections, [Dark Purple]’s design uses an inverting DC-DC converter. The converter takes power from the USB port to charge a capacitor bank up to -110VDC. After the caps are charged, the converter shuts down and a transistor shunts the capacitor voltage to the data pins of the port. Once the caps are discharged, the supply fires back up and the cycle repeats until the computer is fried (typically as long as bus voltage is present). The combination of high voltage and high current is enough to defeat the small TVS diodes on the bus lines and successfully fry some sensitive components—and often the CPU. USB is typically integrated with the CPU in most modern laptops, which makes this attack very effective.
Thanks for the tip, [Pinner].
Over the last few years, [Tobias] has repaired a number of USB Flash drives. This strikes us as a little odd, given small capacity Flash drives are effectively free in the form of conference handouts and swag, but we’re guessing [Tobias] has had a few too many friends lose their thesis to a broken Flash drive.
In all his repairs, [Tobias] found one thing in common The crystal responsible for communicating with the USB controller is always broken. In a way, this makes a lot of sense; everything else on a Flash drive is silicon encased in an epoxy package, where the crystal is a somewhat fragile piece of quartz. Breaking even a small part of this crystal will drastically change the frequency it resonates at making the USB controller throw a fit.
[Tobias]’ solution for all his Flash drive repairs is to desolder and change out the crystal, bringing the drive back to life. Some of the USB Flash drives even have multiple pads for different crystal packages, making it easy to kludge together a solution should you need to repair a Flash drive five minutes ago.
[Aram Bartholl] is building his own filesharing network that screws those fat cats who want to control your freedom. He’s added file cache devices throughout NYC (five so far but more to come) that are anonymous and free to use. Upload what you want, download what you want. They’re completely offline which means monitoring who’s doing what gets a lot harder and quite possibly requires a warrant from a Judge (we’re obviously not legal experts, your mileage may vary).
As for the slew of comments that are sure to point out the dangers of malicious USB device; We think everyone knows they’re taking on some risk when connecting to a USB plug protruding from a brick wall.