You Would't Be Very Happy If You Found This USB Device In A Dumpster  - Page 1
Forum section: electronics / general

author: Sionyn
author_rank: Frequent Contributor
timestamp: March 10, 2015, 01:17:13 pm
content: http://kukuruku.co/hub/diy/usb-killer

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: March 10, 2015, 01:43:56 pm
content: Seems ridiculously complicated - I'm sure it could be done a lot smaller & simpler than that.With 2.5W potentially available at 5V I'm not convinced you'd need any capacitive storage.

author: electr_peter
author_rank: Unknown
timestamp: March 10, 2015, 01:49:22 pm
content: It is comparable to putting salt in sugar, leaving notes/coins with glue/nasty stuff on pavement, putting sharp objects on road to puncture tyres, etc. - d*ck moves in general sense. Why waste your time and produce dangerous deviceon purposeso some poor person would destroy his/her equipment? These things are not even funny in a prank sense.Just don't be such a d*ck.

author: codeboy2k
author_rank: Super Contributor
timestamp: March 10, 2015, 01:56:51 pm
content: And this is just one more reason not to trust USB dead-drops.http://en.wikipedia.org/wiki/USB_dead_drop

author: Artlav
author_rank: Frequent Contributor
timestamp: March 10, 2015, 02:08:04 pm
content: Naturally, the next question is - how to safely check a USB device you found, keeping pranks like that in mind?Would a USB isolator be enough?

author: free_electron
author_rank: Super Contributor
timestamp: March 10, 2015, 02:11:58 pm
content: i think i'll go build a 50 megaton hydrogen bomb. Just in case i find one of these usb sticks and find out what country the maker lives in ... you have been warned

author: Artlav
author_rank: Frequent Contributor
timestamp: March 10, 2015, 02:19:33 pm
content: Quote from: free_electron on March 10, 2015, 02:11:58 pmQuote from: blueskull on March 10, 2015, 02:14:18 pmBe advised that there are as much as 10 nukes still missing since the collapse of the USSR, and few were found in private hands in the 90s.Quote from: blueskull on March 10, 2015, 02:10:57 pmI don't mean the straight-to-mains "charger", but just a 110V zapper.AFAIK, isolation chips like ADUM4160 are rated to 1000V of isolation.

author: Bud
author_rank: Super Contributor
timestamp: March 10, 2015, 02:22:25 pm
content: I did not need one - a 16Gb Chinese SD card i got from ebsy killed my two USB 3.0 ports, they do not power anymore. Same card still works on USB 2.0 ports on the same PC.

author: amyk
author_rank: Super Contributor
timestamp: March 10, 2015, 02:40:49 pm
content: Quote from: electr_peter on March 10, 2015, 01:49:22 pmVery ironic to see this and that thread about e-waste in China at the same time...

author: richard.cs
author_rank: Super Contributor
timestamp: March 10, 2015, 04:29:25 pm
content: Quote from: electr_peter on March 10, 2015, 01:49:22 pmMaybe it's just me but I don't see gluing coins to the pavement as nearly such as d*ck move as the others. No harm is done, someone just tried to pick something up, fails, moves on with their life. In the right situation it's not a bad prank, the USB-destroyer on the other hand... I suspect it's made for a specific purpose - to cause econonmic damage to some target organisation by reducing productivity.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: March 10, 2015, 05:13:26 pm
content: Quote from: richard.cs on March 10, 2015, 04:29:25 pmIt's proposed use was just to recreate a story someone heard. Your suggestion may be the only practical use but since when do hobby projects have to be practical?

author: Sigmoid
author_rank: Frequent Contributor
timestamp: March 10, 2015, 07:57:49 pm
content: I kind of remember reading aBastard Operator from Hellstory years before USB became a thing that involved power capacitors and malicious interface circuitry...

author: SeanB
author_rank: Super Contributor
timestamp: March 10, 2015, 08:09:54 pm
content: The SCSI laptop, with the power supply that was basically all NiCd battery and a chunky inverter to kill anything plugged into it.Then the Etherkiller, that was a lovely thing. 2kV isolation on Ethernet did not help if you plugged in headphones, need another consultant .........

author: electr_peter
author_rank: Unknown
timestamp: March 10, 2015, 08:30:05 pm
content: Quote from: richard.cs on March 10, 2015, 04:29:25 pmI meant glue as a substance to stick to fingers/clothes, not as glued to a pavement or other surfaces. There were some TV pranks with glued coins and notes embedded in ice block - these are somewhat funny pranks.

author: German_EE
author_rank: Super Contributor
timestamp: March 10, 2015, 09:20:49 pm
content: 5KV USB Isolatorhttp://www.analog.com/media/en/technical-documentation/data-sheets/ADuM4160.pdf3KV 5V DC-DC Converterhttp://power.murata.com/datasheet?/data/power/ncl/kdc_nmk.pdfAdd leads and connectors to suit.

author: Hydrawerk
author_rank: Super Contributor
timestamp: March 10, 2015, 09:25:36 pm
content: QuoteFuck that. Don't be evil.

author: NiHaoMike
author_rank: Super Contributor
timestamp: March 11, 2015, 02:05:59 am
content: Reminds me of a story with one of those CVS "disposable" digital cameras. For those who don't know, they were (at the time) unbelievably cheap digital cameras that first had USB on a strange connector, with a proprietary protocol that was quickly reverse engineered. Later, they went to some completely proprietary interface (and the quality declined to the point where it's not worth it anymore), so in retaliation, one of the upset hackers rewired a few pins on that connector to the flash cap and returned the camera as "unused". Never heard what happened in the end, but I'd imagine some later customer who bought it to use as intended ended up with the pictures "unretrievable" and the workers at the CVS puzzled at why the machine stopped working when they plugged in the camera.There was also a story many years back when a (then) popular Dell handheld computer (basically a smartphone without the phone) would sometimes damage the USB ports in the PCs they were plugged into. Nobody really knows the problem but many suspected that the connector used tended to short circuit when inserted at an angle.

author: max666
author_rank: Frequent Contributor
timestamp: March 11, 2015, 03:34:49 am
content: Quote from: German_EE on March 10, 2015, 09:20:49 pmWow, the ADuM4160 looks like a surprisingly simple aio solution.I think I'm gonna order one in case I need something floating. Could come in handy.

author: TerraHertz
author_rank: Super Contributor
timestamp: March 11, 2015, 03:41:26 am
content: The 'HV zapper USB stick' is thinking way too hardware-ish. There's a much worse way to achieve the same effect.Who knew that USB thumb drives' internal firmware is able to be hacked to inject malware into any PC it's plugged into? Yep, just plugging in an 'empty' thumb drive can do that. For Windows anyway, I don't know about Linux. Thumb drives cannot be used anywhere you need system security.Secondly, there are numerous ways to brick PCs, using software exploits alone. Hard drive firmware and motherboard BIOS firmware can be overwritten with junk, even CPUs can be trashed by writing crap to their microcode update flash ROMs.There's a recent/current computer security scandal involving malware loaded to hard disk firmware, that can remain utterly hidden in PCs to any investigation short of physically removing the flash chip and dumping contents. Google EQUATION Group - hard disk firmware trojan. Discovered by Kaspersky Labs, very strong indications it was created by a group associated with the NSA/Mossad.Anyway, point being it would be technically possible to load a standard USB thumb drive with malware (in the USB drive's firmware) that would infect a PC with a delayed-action brick-bomb. So the victim wouldn't even know why the PC (and hard disk) died unrecoverably.

author: pickle9000
author_rank: Super Contributor
timestamp: March 11, 2015, 04:04:12 am
content: wow.

author: jlmoon
author_rank: Unknown
timestamp: March 11, 2015, 04:30:22 am
content: Reading this thread, I just hope the evil ones don't get one of these devices in their mix of stuff.To me this type of activity runs along the lines of bomb building and such, lot of innocents get hurt at the hands of others, this type of behavior should not be happening.

author: pickle9000
author_rank: Super Contributor
timestamp: March 11, 2015, 04:56:24 am
content: I think this could be the start of a new thing. At least in the form of detection. Having a "safe stick" usb checker on a laptop would probably be a feature.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: March 11, 2015, 05:25:01 am
content: I find it hilarious that relatively recent sci-fi history used to write doomsday scenarios about the days when "everything is a computer".Well guess what? That day is here!And guess what? Shit's broken, unsecure, riddled with bugs, and dropping like stones! Whod'a thunk it?The silver lining...or, perhaps, tin lining, shall we say... is that, it works well enough, when it does. Just like anything else, whether made of solid materials, analog circuits or software. You'd be a fool to think products have ever been worse; things were much worse "back then". There were simply less of things to complain about!Tim

author: EEVblog
author_rank: Unknown
timestamp: March 11, 2015, 06:06:51 am
content: Quote from: free_electron on March 10, 2015, 02:11:58 pmA simple lossy gun-type uranium bomb is orders of magntude simpler and will equally do the trick.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: March 11, 2015, 07:05:44 am
content: Quote from: EEVblog on March 11, 2015, 06:06:51 amAnd even if that doesn't work, you can always chuck some Co-60 into the casing, or something, so no one still wants to touch it!Tim

author: Mechanical Menace
author_rank: Super Contributor
timestamp: March 11, 2015, 12:10:15 pm
content: Quote from: TerraHertz on March 11, 2015, 03:41:26 amOn Linux, Mac, etc it probably is possible but just not worth any ones time to implement. Linuxes, BSDs, and the like are also much quicker at pushing out security updates than MS, I've known fixes be available mere hours after a problem was discovered. Though I will admit MS have got much better of late.QuoteIf you want total security you have only 1 option, don't store any information in any form. Don't write it down, store it on a computer, tell it to friends, and most of all don't remember it yourselfThere's always a fine balance between productivity and security, and the more you need of one the less you can have of the other.

author: jlmoon
author_rank: Unknown
timestamp: March 11, 2015, 12:32:09 pm
content: Sounds like a new venture, the detector device.

author: poorchava
author_rank: Super Contributor
timestamp: March 11, 2015, 02:15:29 pm
content: I'd totally buy it. And leave it in a visible place, where it would tempt the pickpockets. We have a plagues of them on and off, mainly operating in trams and buses.If you know a guy named Travis Goodspeed (a hacker known from security conferences), he gave a speech a few years ago presenting an idea of self-conscious thumb drive, which could detect whether it was inserted into its owners machine or not. If not it would present false data or self destruct.Long live forensic investigators and their machines

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: March 11, 2015, 09:29:13 pm
content: ..of course you could make something even more subtle - have it work as a USB memory with something "interesting" on it, then fail at some random time later. That way it may get inserted into a few more PCs before people figure it out.Or have it only zap if /when the PC is powered down - good chance it will be removed before anyone turns the PCB on again, by which time the cause of the "problem" may have gone...I can think of a few less destructive joke USB sticks - how about one full of fake blood that starts "bleeding" when plugged in.Or a motor that makes it eject itself a few secs after being plugged in.

author: miguelvp
author_rank: Super Contributor
timestamp: March 12, 2015, 08:50:55 am
content: Quote from: mikeselectricstuff on March 11, 2015, 09:29:13 pmI like that

author: Rerouter
author_rank: Super Contributor
timestamp: March 12, 2015, 08:56:22 am
content: that last one i think is the idea to beat, have it so it pushes itself out enough to loose connection at a random time, or when someone tries to access a folder, called "private"

author: FrankBuss
author_rank: Unknown
timestamp: March 12, 2015, 09:17:52 am
content: Quote from: electr_peter on March 10, 2015, 01:49:22 pmI agree. At least it should be labeled "Danger! Don't connect this USB device to a computer, it will destroy it!". Then nobody would insert it into a computer

author: tom66
author_rank: Super Contributor
timestamp: March 12, 2015, 09:28:55 am
content: Quote from: mojo-chan on March 12, 2015, 09:11:27 amSomething like this:http://www.thinkgeek.com/product/ae83/

author: max666
author_rank: Frequent Contributor
timestamp: March 12, 2015, 12:47:22 pm
content: Quote from: FrankBuss on March 12, 2015, 09:17:52 amYeah, sure! "nobody"Have you learned nothing about the people of this planet yet?!

author: cosmicray
author_rank: Frequent Contributor
timestamp: March 12, 2015, 01:36:23 pm
content: Quote from: mojo-chan on March 12, 2015, 09:11:27 amMore interestingly would be one that watches for a string of 1-30 characters, followed by a tab, then another string of 1-30 characters and an enter key. When observed, store them for future inspection.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: March 12, 2015, 03:24:58 pm
content: Quote from: FrankBuss on March 12, 2015, 09:17:52 am**COUGH*** FTDI

author: electr_peter
author_rank: Unknown
timestamp: March 12, 2015, 08:48:46 pm
content: Quote from: mikeselectricstuff on March 12, 2015, 03:24:58 pmSimilar minds find similar ways to express themselves. After last FTDI action one may wonder if FTDI name is misspelled with 2 characters to hide real picture...

author: richard.cs
author_rank: Super Contributor
timestamp: March 12, 2015, 09:46:24 pm
content: Quote from: EEVblog on March 11, 2015, 06:06:51 amAh yes, the biggest secret of the atom bomb - how easy they are to build.Despite claims to the contrary gun-type bombs can be made to work with plutonium too (much easier to make/separate), they'd just be too long to fit in aircraft or missiles. Certainly within the abilities of a final-year physics or engineering student.

author: lapm
author_rank: Frequent Contributor
timestamp: March 12, 2015, 11:12:18 pm
content: Quote from: max666 on March 12, 2015, 12:47:22 pmLOL, i was about to say that. No matter how much warning text there is, there is always someone that will still plug it in...

author: MadTux
author_rank: Frequent Contributor
timestamp: March 13, 2015, 12:27:52 am
content: Nor creative or funny.It's like boobytrapping shit in war, except it kills random computers instead of humans. Next they invent the booby trapped USB drive by filling it with explosives and connecting a lightbulb filament onto 5V line, so it wrecks both computer and the hand of operator. Even more simple and unfunny.Logic consequence would be to open every flash drive you get, because you can't trust no one any more. Not cool.

author: NiHaoMike
author_rank: Super Contributor
timestamp: March 13, 2015, 01:47:38 am
content: Now that I think of it, a possible legitimate use could be a countermeasure against hacking devices in public USB charging outlets.

author: suicidaleggroll
author_rank: Super Contributor
timestamp: March 13, 2015, 02:10:37 am
content: Quote from: blueskull on March 13, 2015, 12:43:28 amExcept apparently at least one person already has...so yeah, people ARE building these, and ARE spreading them out. Maybe nobody on this forum, but that doesn't mean it's not happening.The link earlier to the USB device that injects random mouse movements and keyboard strokes - THAT is a prank. The device linked in the OP is not a prank, it's a just an asshole move.

author: suicidaleggroll
author_rank: Super Contributor
timestamp: March 13, 2015, 02:13:56 am
content: Quote from: NiHaoMike on March 13, 2015, 01:47:38 amBy destroying the USB charging outlet? That doesn't hurt anybody but the organization trying to provide a service to their customers and any customers who try to use it.That's already enough of a problem. Most airports I visit nowadays have USB charging ports built into seats or charging stations, and I have yet to find one that actually works. Fucking assholes ruining it for everybody else..."this is why we can't have nice things"

author: NiHaoMike
author_rank: Super Contributor
timestamp: March 13, 2015, 03:17:28 am
content: Quote from: suicidaleggroll on March 13, 2015, 02:13:56 amA real charger will have the data pins connected to each other so nothing would happen if you apply a voltage spike to them. What it targets are malicious outlets that try to break into devices plugged into it.

author: Red Squirrel
author_rank: Super Contributor
timestamp: March 13, 2015, 04:03:57 am
content: Reminds me of this:http://www.fiftythree.org/etherkiller/And I can't believe that site is still up. I remember finding that back when I was in high school, maybe even before. Hilarious read. "Now local talk is really local".

author: Psi
author_rank: Super Contributor
timestamp: March 13, 2015, 06:38:44 am
content: Make it pretend to be a USB keyboard first.Have it do some windows keyboard shortcuts as soon as its plugged in. eg, windows key+R ENTER, then type notepad and ENTER again.Now have it type out"Your PC will be destroyed in 60 seconds unless you answer the following math problem by tapping the capslock key the correct number of times.The question is 9 * 7 good luck"(use the capslock key for the answer because a usb keyboard can detect the leds flashing)

author: pickle9000
author_rank: Super Contributor
timestamp: March 13, 2015, 06:59:50 am
content: Quote from: Psi on March 13, 2015, 06:38:44 amThe question is: Do you care what the answer is?

author: Mechanical Menace
author_rank: Super Contributor
timestamp: March 13, 2015, 07:00:26 am
content: Quote from: suicidaleggroll on March 13, 2015, 02:10:37 amNo, they aren't spreading them around. One person has made a PoC...

author: miguelvp
author_rank: Super Contributor
timestamp: March 13, 2015, 07:06:44 am
content: Quote from: pickle9000 on March 13, 2015, 06:59:50 amBut the problem should be 6 * 7 so at least most will know it's harmless.But if it's not, well.... unplug the device you have plenty of time before you are supposed to finish entering the number

author: pickle9000
author_rank: Super Contributor
timestamp: March 13, 2015, 07:23:13 am
content: Or you blow the computer on the first keypress. Sorry Arthur the answer is not 1.

author: suicidaleggroll
author_rank: Super Contributor
timestamp: March 13, 2015, 02:09:24 pm
content: Quote from: Mechanical Menace on March 13, 2015, 07:00:26 amI'm not talking about the guy in the link in the OP who made one, I'm talking aboutwhyhe made one...he wasn't the first, he was testing whether or not the article about one of these devices out in the wild could be true. While the fact that this device is absolutely possible and would result in similar damage as described in the article doesn't mean the article is true, my money says it is. THAT'S the one I'm talking about.It also wouldn't surprise me that, thanks to that blog, there are a handful more out in the wild now (or will be soon).

author: Mechanical Menace
author_rank: Super Contributor
timestamp: March 13, 2015, 03:45:00 pm
content: Quote from: suicidaleggroll on March 13, 2015, 02:09:24 pmOh, I read it as recreating an urban myth. Mythbusters style "this is what they said happened, it wouldn't, so lets make it happen!!!" style of thing.And tbh you can't keep stuff secret just cause it could be misused. All that does it make most unaware of the risks.