Ask Hackaday: Is USB Robust Enough?

April 29, 2019 by Mike Szczys 60 Comments

Earlier this month a single person pleaded guilty to taking down some computer labs at a college in New York. This was not done by hacking into them remotely, but by plugging a USB Killer in one machine at a time. This malicious act caused around $58,000 in damage to 66 machines, using a device designed to overload the data pins on the USB ports with high-voltage. Similar damage could have been done with a ball-peen hammer (albeit much less discreetly), and we’re not here to debate the merits of the USB Killer devices. If you destroy property you don’t own you should be held accountable.

But the event did bring an interesting question to mind. How robust are USB ports? The USB Killer — which we’ve covered off and on through the years — is billed as a “surge testing” device and operates by injecting -200 volts DC on the data lines of the USB connection. Many USB ports are not protected against this and the result is permanent damage to the computer hardware. Is protection for these levels of abuse necessary or would it needlessly add cost to our machines?

A chip like the TPD4S014 has ESD protection on the data lines that is rated up to +/- 1500 volts, clamping to ground to dissipate the energy. It’s a solution that should protect against repeated spikes on the data lines, as well as short circuits on the power lines and over/undervoltage situations.

The ADuM4160 is an interesting step up from this. It’s designed to provide isolation between a USB host and the device connected to it. Rather than relying on clamping, this chip implements isolation through air core transformers. Certainly this would be overkill to install in every product, but for those of use building and testing USB devices this would save you from “Oops, wrong USB cable” moments at the work bench.

Speaking of accidents at the bench, there is certainly a demand for USB isolation outside of what’s built into our computers. Earlier this year we saw a fantastic take on a properly-designed USB power strip. Among the goals were current limiting, undervoltage protection, and a proper power disconnect switch for each port. The very need to design your own reminds us that consumer manufacturers are often lazy in their USB design. “Use a USB hub” is bad advice for protection at the workbench since quality of design varies so wildly.

We would be interested in hearing from anyone who has insight on standards applying to equipment continuing to survive over current or over voltage events and remain functional. There are standards like UL-60950 that should apply to USB. But that standard includes language about failing safe for the operator, not necessarily remaining functional:

After abnormal operation or a single fault (see 1.4.14), the equipment shall remain safe for an OPERATOR in the meaning of this standard, but it is not required that the equipment should still be in full working order. It is permitted to use fusible links, THERMAL CUT-OUTS, overcurrent protection devices and the like to provide adequate protection.

So, we’re here to ask you, the readers of Hackaday. Are our USB devices robust enough? Do you have a go-to USB protection chip, part, or other circuit you like to use? Have you ever accidentally killed a USB host device (if so, how)? Do you have special equipment that you depend on when developing projects involving USB? Let us know what you think in the comments below.

The USB Killer: Now Faster, Better, More Anonymous

February 19, 2017 by Brian Benchoff 118 Comments

A few years ago, [Dark Purple] built the USB equivalent of an RJ45 connector wired into mains power. The USB Killer is a simple device with just a FET, a few high voltage caps, a DC/DC converter, and a USB connector. Plug this device into your computer and -220V is dumped directly into the USB signal wires. This kills your laptop dead.

Over the years we’ve seen the USB Killer evolve from a hand-etched PCB to something less discrete but more discreet. It was a crowdfunding campaign run by a company in Hong Kong, and a few months ago this new commercial version was released.

Now, the USB Killer V3 is out. It provides 1.5 times the power to your poor USB ports, with power surges twice as fast. There’s also an anonymous version that looks like every other USB thumb drive sourced from Hong Kong. This is your warning: never, ever plug an unknown USB thumb drive into your computer.

While a product announcement really isn’t news, it is extremely interesting to take a look at how something that should not exist is being marketed. As with all electronic destructive devices, it’s on your Amazon recommended products list alongside tactical kilts, fingerless gloves, beard oil, and black hoodies. This is pentesting gear, with an anonymous edition for your friend, the hacker called four chan. Don’t think too much about how you’re going to get data off a laptop you just killed, or how you would go undetected by destroying equipment; this is cool hacker stuff.

In addition, the USB Kill 2.0 is FCC and CE approved. This allows you to, “test in complete safety” (their emphasis, not ours). We have no idea what this actually means.

The USB Killer Now Has Commercial Competition

September 13, 2016 by Jenny List 96 Comments

With a proliferation of USB Flash disk drives has come a very straightforward attack vector for a miscreant intent on spreading malware onto an organisation’s computer network. Simply drop a few infected drives in the parking lot, and wait for an unsuspecting staff member to pick one up and plug it into their computer. The drives are so familiar that to a non-tech-savvy user they appear harmless, there is no conscious decision over whether to trust them or not.

A diabolical variant on the exploit was [Dark Purple]’s USB Killer. Outwardly similar to a USB Flash drive, it contains an inverter that generates several hundred volts from the USB’s 5 volts, and repeatedly discharges it into the data lines of whatever it is plugged into. Computers whose designers have not incorporated some form of protection do not last long when subjected to its shocking ministrations.

Now the original has a commercial competitor, in the form of Hong Kong-based usbkill.com. It’s a bit cheaper than the original, but that it has appeared at all suggests that there is an expanding market for this type of device and that you may be more likely to encounter one in the future. They are also selling a test shield, an isolated USB port add-on that allows the device to be powered up without damaging its host.

From the hardware engineer’s point of view these devices present a special challenge. We are used to protecting USB ports from high voltage electrostatic discharges with TVS diode arrays, but those events have an extremely high impedance and the components are not designed to continuously handle low-impedance high voltages. It’s likely that these USB killers will result in greater sales of protection thermistors and more substantially specified Zener diodes in the world of USB interface designers.

We covered the original USB Killer prototype when it appeared, then its second version, and finally its crowdfunding campaign. This will probably not be the last we’ve heard of these devices and they will inevitably become cheaper, so take care what you pick up in that parking lot.

[via Extremetech]

Hackaday Links: February 7, 2016

February 7, 2016 by Brian Benchoff 25 Comments

For a very long time, the original, 11 foot-long on-screen model of the USS Enterprise from Star Trek the original series – “NCC one seven O one. No bloody A, B, C, or D.” – was housed in the Smithsonian’s Air and Space Museum in Washington, DC. Recent visitors may have noticed the Enterprise is no longer on display. It’s being restored by the finest aircraft conservators in the world. There are a few great videos showing off how much goes into restoring a cultural icon.

Last weekend Hackaday visited Sparklecon in Fullerton, CA. This means I was in LA on the last Saturday of the month. What’s so special about that? The W6TRW Swap Meet at Northrop Grumman in Redondo Beach. Here’s the pics from that. The best thing I found? A wooden acoustic coupler modem for $15. Once I told the guys at the booth what it was, the price went up to $20. Still worth it.

What’s the worst thing about modern computers? They’re all LCDs, and that means worse resolution, terrible colorspace, and monitors that are very, veeeerrrrryyyy wide. The consequence of this is a complete and total lack of screen savers. Never fear, because the flying toaster is back, this time as an SD card holder. It’s 3D printable, so if you have some white, silver, and black filament sitting around, you know what to do.

The USB Killer hit the tips line a few times this week for inexplicable reasons. We’ve seen it before, but we haven’t seen it again. Surprisingly, no one – outside a bizarre Indiegogo campaign that shouldn’t exist – has made their own USB killer. Here’s your call to action: build a USB killer, and I’ll test it out.

An SDIP-64 chip compared to a DIP-28 chip. Note the finer lead spacing on the SDIP device.

There’s more variety to your standard DIP-packaged chips than you might expect. The weirdest of these – at least when it comes to perfboard construction – is the SDIP, or Skinny Dual In-line Package. Instead of having a standard 0.1″ pitch between leads, the SDIP has a 0.070″ pitch. [Chuck] was having some problems looking for SDIP to DIP adapters until he found this amazing trick the connector companies don’t want you to know about. Just plop the chip in at a 45º angle, bend a few pins, and you’re good to go.

The USB Killer – Now A Crowdfunding Campaign

November 6, 2015 by Brian Benchoff 128 Comments

Kickstarter, Indiegogo, and every other crowdfunding site out there frequently have projects that should never be products. The latest promises to protect you from security breaches and identity theft by blowing up your computer. It’s the USB Killer, and for only $99 USD, you too can destroy the USB port in your computer and everything else attached to it.

The USB Killer is a device that plugs into the USB port on any computer, charges up several caps, and dumps all that voltage back into the computer. The process repeats until something breaks. We’ve seen it used on a poor Thinkpad X60, and from the video evidence it does exactly what it’s designed to do: kill a computer.

The Indiegogo campaign for the USB killer comes with a web page for the campaign that goes over the function of the device in much more detail. Inside the USB killer is a DC/DC converter that charges a few capacitors to -110V. When the caps are charged, that voltage is dumped back into the USB port where something will happen. Somewhat surprisingly, the folks behind the USB Killer have a video of a computer not dying when the USB Killer is plugged in. Only killing the USB port in a computer is not a guaranteed functionality, as the Indiegogo campaign has the following disclaimer: “Please be aware: USB Killer may cause damage to the motherboard, depending on your computer. By making a pre-order you acknowledge that you are aware of this fact.”

The USB Killer, Version 2.0

October 10, 2015 by Brian Benchoff 167 Comments

There are a lot of stupid things you can do with the ports on your computer. The best example is the Etherkiller, an RJ45 plug wired directly to a mains cable. Do not plug that into a router. USB is a little trickier, but with a sufficient number of caps, anyone can build a USB killer that will fry any computer (.ru, Google Translatrix)

The USB Killer v2.0 is [Dark Purple]’s second version of this device. The first version was just a small board with a DC/DC converter, a few caps, and a FET. When plugged in to a computer, the converter would charge the caps up to -110V, dump that voltage into the USB signal wires, and repeat the entire process until the computer died. This second version is slightly more refined, and it now dumps -220V directly onto the USB signal wires. Don’t try this at home.

So, does the device work? Most definitely. A poor Thinkpad X60 was destroyed with the USB killer for purposes of demonstration in the video below. This laptop was originally purchased just for the test, but the monster who created the USB killer grew attached to this neat little laptop. There’s a new motherboard on the way, and this laptop will live again.

Continue reading “The USB Killer, Version 2.0” →