WARNING -- USB Killer "Thumb Drives"

Some of you may already be aware of these. If so, then just consider this a reminder.

Friday, two different laptops for my work succumbed to USB Killer 'drives.' I was on my way back from a job that was cancelled when I was asked to head to a different job to assist, as the Event Manager's laptop wouldn't turn on. When I showed up, I set about getting the job downloaded over the VPN to my laptop and grabbed what I thought was a USB stick off of the table. When I put it into my laptop, I heard a "snap!" and my laptop was dead. It wouldn't turn on any more.

I figured it was probably a defective thumb drive and took it back to the office. I was a bit upset, so I took a hammer to it. The stick didn't break, as much as break open. When I looked inside, the markings on the PCB enlightened me as to what happened. It was marked "USB Killer V3.0FK, -215 VDC, High Voltage!"

A quick Google search and I discovered https://www.usbkill.com has these nasty little devices for sale. I was hit by the "Anonymous" model. It's an all-black version of the blue and silver thumb drives my work uses.

Be very careful of what you put in your laptop or connect to any of your electronic equipment. This nasty little device had several high-value capacitors and a coil to boost the 5VDC of the USB port to -215VDC. It then pulses that through the attached port until the device dies.

What the literal F***???

Lets hope they don’t branch out into pacemaker “testers”
Absolutely stupid and irresponsible to sell an “anonymous” model.
Also, if the point is to see if the system is surge protected, who in their right mind would want to “test” their device if “failure” meant destruction?

File a police report? That's probably a Felony.

dhbarr said:

File a police report? That's probably a Felony.

Click to expand...

WHY would this be unlawful? Current law isn't that savvy.

dhbarr said:

File a police report? That's probably a Felony.

Click to expand...

Probably, but your chances of getting anything out of it is zero, possibly negative. Computer-related crimes are such big business now that unless there are literally millions of dollars involved the authorities won't even talk to you. At my day job, a few years ago somebody tried to pawn themselves off as being one of our purchasing agents, and they tried to buy hundreds of hard drives from a large national distributor on our account. They even had the right information for the credit check. The only thing that stopped it from being shipped was that the rep always worked through me, so he called me and asked who this guy was. I told him that it wasn't us, and we talked about playing along and setting up a fake shipment to the shipping address (which turned out to be an empty house in Texas, even though we don't have any presence outside California), but we killed the idea after we found out that the local authorities weren't interested in catching these guys. $500k wasn't big enough for them. We let it go... my guess is that they found somebody else to rip off.

FredA said:

WHY would this be unlawful? Current law isn't that savvy.

Click to expand...

Vandalism ( a misdemeanor ) of sufficient value almost always switches to destruction of property ( a felony ). Somewhere between the cost of a board swap and a complete replacement we're almost assuredly across that line.

It's not like somebody put a defective or damaged device there. Someone put a device there designed to do exactly what it did. They may as well have run 120VAC through it, hit it with a blowtorch, or submerged it in saltwater.

I'd file a police report so I have something to show the insurance company, and I wouldn't be quiet about it. That ought to put The Fear into whoever thought that would be a lark. ( note that if actually asked to prefer felony charges I would ask for deferment, community service, monetary fine )

Yeah but since it was a company laptop that almost sounds like industrial espionage charges could be applied. At Volkswagen I saw numerous cases of these creep as f*** unwanted kinds attacks on Funac CNC machinery. Mainly the mig welders were vulnerable to losing zero by programmers who weren’t employees of VW who illicitly entered premises and tampered with **** until funac mig weld robots weren’t welding in the assigned locations on car parts for structural welds. When we first saw this kind of attack we went not walking but sprinting into directors meeting. Worst case was a PLC cable cut from behind a locked box that shut down an assembly line for four hours costing millions in downtime. Telling the directors about what we saw got them fuming mad. They literally screamed this isn’t robot fault this is SABOTAGES... They pulled files of everyone on shifts. It turned out to not be Volkswagen employees that caused the problem. Nobody knew who the f*** those unwelcome guest were but the end results could’ve killed customers. Multiple people were saying I’ve never seen X person before!!! We caught thirty atlas SUV fully assembled minus mig welds in critical locations on rear right rails to hold the car frame together. It was horrific. I’m glad I didn’t get a job there after internship.

These kinds of white collar hacking computer crimes are increasingly frequent. I’d venture out to suggest there’s probably an illicit group of saboteurs doing this for illicit gains. It’s one thing if company IT wants to test its machine to destroy it if needed to find fault in security under controlled conditions. It’s another scary thing when you have industrial spy stuff causing havoc on production lines with consequences of results could literally legit kill product end users or factory techs. The problem with devices like this is the havoc they cause when used by not friendly helpful people.

Okay, I've been a bit slow in responding to this post, but let me expand on the chain of events:

One of our Event Managers had an emergency come up right before an event. Cancellation was not an option, as it would have been our fault and cost my employer money. My District Manager went to the EM's house to pick up his laptop and other equipment so that an alternate EM could run the job.

Meanwhile, my event was cancelled due to customer prep issues. I still had a minor event to complete at that site, but the main event was cancelled. I texted my Area Manager and DM to say I was headed back to the office when I received the instructions to head to the second event, less than 8 miles away.

The USB Killer drive was in the bag of the absent EM. The backup EM had tried to use it to program equipment and didn't associate it with what happened to the absent EM's laptop until after my laptop died. It was laying on the table when I picked it up to do the exact same thing.

Was this intentional? I doubt it. Was it negligent on the part of the absent EM to have such a device in his bag? Absolutely. The AM and DM are seriously looking into this situation and will take the appropriate steps. Meanwhile, I'm just warning folks to be careful what you put in your computers.

Ahh, time to award a Laptop Killer Trophy at the next all hands if they're a good egg.

One exploit to hacking into a secure system is just to leave thumb drives with malware where people will find them. People being people will frequently check to see what’s on the drive. My group was always trying to train people not to ever use a usb drive without knowing exactly where it came from. I guess this is one way to make that point.

Our IT people put together a little experiment and created their own “malware” on flash drives that they left around, including the parking lot. Most of the drives were just turned into the receptionist, who duly gave them to IT. But a few unsuspecting souls put them in a computer to see who they belonged to. Fortunately the only side effect was to message IT who had breached security by putting an unknown flash drive into their computer. It was a fun experiment and a timely reminder.

What a crappy trick!

So, I spoke with the errant EM today. He said that he found it on the ground at an event I was running last Wednesday.

Let's just say that I'm a bit skeptical.

Similarly, our IT dept send out a fake phishing email as a test.

Guys! I'm in tears after watching this video! Thanks for that!

scsager said:

Click to expand...

John Kemker said:

Guys! I'm in tears after watching this video! Thanks for that!

Click to expand...

The first thing I thought of when I saw this thread is that Electroboom video. All of his videos are fun and interesting - that one especially so.

After reading this thread and watching the video I will longer pick up free USB sticks at any convention or government functions! Thank you for the thread.

BABAR said:

Also, if the point is to see if the system is surge protected, who in their right mind would want to “test” their device if “failure” meant destruction?

Click to expand...

Used to do it daily. The singular most satisfying and stress reducing job I ever had...

H_Rocket said:

Used to do it daily. The singular most satisfying and stress reducing job I ever had...

Click to expand...

Okay, but I assume that was either a sample or test run.

Doing this on regular equipment for daily use, not so good

Kinda reminds me of that Cheech and Chong skit.
Paraphrased

Hey, what’s that?

Looks like dog poo.

What does it feel like?

Feels like dog poo.

What does it smell like?

Smells like dog poo.

What does it taste like?

Tastes like dog poo.

Okay, let’s be careful to walk around it, we sure don’t want to step in it.

BABAR said:

Okay, but I assume that was either a sample or test run.

Click to expand...

We beat the crap out of gear for a paycheck. I had one device that took almost a day and a half of abuse to break. This was not smash-type testing (though we did that too). This was more subtle 'lets see if we can mimic the worst that the typical idiot we issue equipment to will do.

H_Rocket said:

We beat the crap out of gear for a paycheck. I had one device that took almost a day and a half of abuse to break. This was not smash-type testing (though we did that too). This was more subtle 'lets see if we can mimic the worst that the typical idiot we issue equipment to will do.

Click to expand...

It’s amazing how talented those idiots can get!

We found that tomato juice was one of the best things to kill a laptop...

H_Rocket said:

We found that tomato juice was one of the best things to kill a laptop...

Click to expand...

Salty Cola

H_Rocket said:

We found that tomato juice was one of the best things to kill a laptop...

Click to expand...

dhbarr said:

Salty Cola

Click to expand...

Milk....

Why on Earth would you stir your drinks with a laptop???

dhbarr said:

Salty Cola

Click to expand...

There is a name for that, "The Pepsi Syndrome."

It's good fun taking the ESD gun up to 30kV and running it around our spectrometers. We generally do quite well as we design with that testing in mind. Our company also requires us to go way past the regulatory requirements, ensuring we have robust products. I will run contact discharges directly to USB ports (and other similar interfaces) at 15kV.

Really abusing the instruments can be fun. I was doing some rf immunity testing to the required 3V/m and it passed nicely. I then took the yagi off the tripod and poked it in the spectrometer while it was transmitting. The spectrometer didn't miss a beat, but I did manage to erase the EEPROM in it with the strong field .

Packaging testing is fun too, with packaged and unpackaged instruments dropped, rolled, bumped, shunted and vibrates. Very cathartic .

It's standard practice to zap all ports with an ESD gun.
Newer, very high speed ports are the susceptible ones usually as the protection devices add too much capacitance to allow GHz transfer rates.
Thus it's not hard to hurt the D+/D- inputs on USB ports.

However, I've seen simple inputs do wild things.
We zapped a RESET button through one of those "paper-clip holes" that literally blew the corner off a chip on the other side of the PCB.