11 ms·
I am looking at https://usbkill.com/ https://usbkill.com/. What is the purpose of the device? The manufacturer calls it an "ESD tester" yet there is an "anonymo
by stadeschuldt 7y ago
I am looking at https://usbkill.com/ https://usbkill.com/. What is the purpose of the device? The manufacturer calls it an "ESD tester" yet there is an "anonymous" version available: https://usbkill.com/products/usb-killer-v3?variant=44776085642 https://usbkill.com/products/usb-killer-v3?variant=447760856...
- yial 7y agoThey bill it for “pen testers and police” so I would guess it’s really for people who imagine themselves / want to be within that audience. Not to be overly cynical. I suppose some pen testers, or actual CIA type folks might have some need of this type of device... but is that a large enough market?
- stadeschuldt 7y agoI don't buy the pen testing part. I might as well sell a hammer and call it a pen testing device. Funny enough they have the following on their website: "A hammer used maliciously can permanently damage to a third party's device. The USB Killer, used maliciously, can permanently damage a third party's device." Contrary to this device a hammer can be used a useful tool too.
- phire 7y agoIt's designed to prove a point. To prove that USB devices can be malicious. It's probably most useful as an education tool, training staff not to plug random USB devices they find lying around the parking lot into their computers.
- ALittleLight 7y agoI would think a USB containing an info graphic about the dangers of plugging in random USBs is a far more efficient education tool than one that destroys the hardware of your staff. Worse, what if they took it home and used it on a personal device?
- torqueTorrent 7y ago>> training staff not to plug random USB devices... Nothing like some high-consequences IRL training! Perhaps curricula for the Inspector Clouseau police academy?
- geofft 7y agoIt's like hiring a gunman to start shooting up your office to train people about the dangers of social engineering, to prove that some people shouldn't be trusted.
- azimuth11 7y agoBad choice as an example of social engineering, not funny, and doesn’t make sense at all.
- calabin 7y agoI don't think that it was a joke or made in bad faith - rather to demonstrate the logical extreme. Essentially that the logical extreme of dropping computer-destroying USBs to demonstrate that one shouldn't plug strange USBs in the first place is akin to destroying an office that you talked yourself into to prove that you shouldn't have been let in in the first place. Perhaps "shooting up" was a tad too far, but with charity it's a reasonable point nonetheless.
- geofft 7y agoRight, it wasn't supposed to be a joke, and the intended argument was that hiring a gunman as social engineering training makes as much sense as using a computer-destroying USB stick as physical security training—so yes, it was supposed to be a bad example of social engineering. Using a computer-destroying USB stick as an example of physical security threats misunderstands the nature and motivations of attackers. Everyone past childhood (and some in childhood, sadly) understands that there are a few people in this world whose motivation is to cause destruction and hurt simply because they find destruction and hurt enjoyable in themselves. They also understand that such people are rare, and that their threat modeling (which everyone does, even if they don't call it that) should rationally respond to such people by almost ignoring them—otherwise you find yourself not leaving your house for fear that there's a gunman on your block. The motivations of people who want to actually get something out of you are quite different. They're not interested in destruction, because that would harm their target. They're usually interested in being undetectable. A social engineer will pretend to be locked out, ask meekly to be let in, and behave like a normal employee until they get what they need and leave normally. Defenses like "don't let people tailgate" work for those people. A gunman will just shoot you, break the door, ignore the alarm, and keep shooting until the cops kill them. Similarly, someone who's trying to attack your business with a malicious USB drive will give you a USB drive that appears to be a normal one, that maybe pops up a terminal window very briefly and then disappears. You likely won't notice that you made a mistake, and you'll probably see an actual drive pop up on screen. Someone who's trying to attack your business will generally not give you a USB drive that destroys your computer immediately. (For most businesses, computers are not worth much compared to the secrecy of the data they contain, anyway, which is why full-disk encryption is a reasonable defense; it assumes that a computer might be lost and that this is recoverable.) So a good security training program should say "These are ways where people might try to subtly break in to gain access that you might not have thought of before," not "Sadistic sociopaths exist, wear plate armor at all time."
- saulrh 7y agoMight make sense, yeah. How many computers would get blown up during such a test, and how much productivity would be lost and how much money would it cost? What is the expected cost of a major breach or malware infection? How much less likely does a breach or malware infection become as a result of leaving one of these laying around? I actually wouldn't be surprised if leaving these did come out positive, in much the same way that regular fire drills come out positive.
- torqueTorrent 7y agoWhen you're holding a hammer, everything looks like a nail!
- moftz 7y agoI can't even imagine a situation where police would want to destroy a running device that could likely have evidence stored in volatile memory. Even if it was their own device that they were retiring, it doesn't even wipe data, it just destroys the logic/motherboard. Hardware designers might want one to test out their mitigation circuit but once your design, why do you need a USBkill anymore? This thing just seems like a destructive version of those annoyance toys like a TV-B-Gone.
- theandrewbailey 7y agoI've never heard of TV-B-Gone. > During the 2008 Consumer Electronics Show, an individual associated with Gizmodo brought a TV-B-Gone remote control and shut off many display monitors at booths and during demos affecting several companies. These actions caused the individual to be banned for life from future CES events. https://en.wikipedia.org/wiki/TV-B-Gone https://en.wikipedia.org/wiki/TV-B-Gone
- squarefoot 7y agoThe innocuous use of TV-B-Gone devices was to shut off at once all TV sets at malls; it was rather a prank than a destructive act, with the added benefit of getting some peace.
- xattt 7y agoWas there a TV-come-on to turn on the mall TVs in the morning?
- squarefoot 7y agoNot that I know of, but technically doable since all it needs is transmitting through infrared the corresponding signal variants according to different brands. By modifying the source one could for example set all TVs to maximum volume, or tune them to channel 666, or even give different commands to different brands as they share the same IR codes.
- 7y ago
- secfirstmd 7y agoAlso activists / journos in some countries. I know we have looked at various emergency destruction techniques over the years.
- Shaanie 7y agoUSB killer would not be an appropriate way to do that, it'd just give a false sense of security.
- wiseleo 7y agoI wouldn't be so sure. Frying an SSD efficiently is a good use.
- gsich 7y agoBut this is USB.
- krisoft 7y agoYes, efficiently frying an SSD can be a goal. No, this device does not do that. "I wouldn't be so sure." is not the right test to pick. Yes it might destroy the SSD, but more likely just burns out something on the motherboard. When you are picking an emergency destruction method your test should be: "I'm reasonably certain that this irreparably destroys the data"
- secfirstmd 7y agoTrue. But options are limited. Something is better than nothing in a scenario where secret police are at your door.
- 8note 7y agoI could see this being used to check USB chargers to make sure they don't catch fire when weird things happen
- neaanopri 7y agoI mean, it's not like it's expensive to manufacture! One person soldering and maybe a single board and usb plug, its probably easy to make money if you can sell them for $30 or so in the volumes of 100's.
- wodenokoto 7y ago> Is the device safe? > The USB Kill and the USB Kill Testing Shield are safe to use. Both devices have been manufactured, tested and certified as CE Approved. Test in complete confidence. This device that is designed to destroy computers is perfectly safe to use ... I don't know what to say to that.
- 0-_-0 7y agoSafe for the user, not to the computer I assume.
- londons_explore 7y agoI kinda doubt that. If you unplug it while in use and stick a key into the USB plug, you might get a painful surprise...
- anonlastname 7y agoI could see it being useful for when you want an easy way to get a high voltage spike out of a 5v power supply. For example, if you wanted to build a board for igniting the gas in a potato gun that ran off of a USB power bank.
- TeMPOraL 7y agoSpeaking of power banks, what would happen if you plugged this device directly to one?
- vortico 7y agoOnly one way to find out!
- huseyinkeles 7y agomost power banks don't have the data lines, and as far as I see this device uses the data lines to destroy the host. So I'll guess nothing would happen.
- londons_explore 7y agoYou could design one which did destruction via the power lines if you wanted to. That's much harder though because power lines tend to have big-ish capacitors on them.
- semi-extrinsic 7y agoThen you want something like one of these instead: https://www.ebay.com/itm/DC-3V-5V-Arc-Generator-High-Voltage-Boost-Transformer-DIY-Kit-Electronic-Lighter-/323225595587 https://www.ebay.com/itm/DC-3V-5V-Arc-Generator-High-Voltage... You also want to use the gas dispenser from a Paslode impact gun, an air mattress inflator and a Zodiac check valve for the air purge.
- acchow 7y ago"-200VDC is discharged over the data lines of the host device. This charge/discharge cycle is repeated many times per second, until the USB Killer is removed" Is there any device that is supposed to survive this? In other news, throwing your computer in a fire also reveals a serious vulnerability.
- mfgs 7y agoYou'd need opto-isolated data lines. I can't see any common devices having that.
- ShorsHammer 7y agoNewer Apple devices should be protected.
- SeanLuke 7y agoWhy?
- egwynn 7y agoFor a time, macbooks had opto-isolated USB ports[0]. I think they don’t anymore though. [0] https://github.com/usbkill/community/wiki/Consumer-Laptop-Hardware https://github.com/usbkill/community/wiki/Consumer-Laptop-Ha...
- SeanLuke 7y agoCall me highly skeptical. Every reference I've seen to this claim seems to point back to usbkill.com making it itself. The problem is: optoisolators are very slow. Building one which goes faster than 12Mbps would be nontrivial; I do not think such a thing existed in 2014 (which usbkill is claiming). This implies that Apple has alien technology. I think it's something else.
- 7y ago
- gruez 7y ago>The manufacturer calls it an "ESD tester" yet there is an "anonymous" version available plausible deniability. selling devices specifically for committing crimes is illegal. that's why all the bong shops say it's "for tobacco use only".
- cronix 7y ago> that's why all the bong shops say it's "for tobacco use only" Unless you're in a state that's legalized it.
- subway 7y agoIf you use that word again, we'll have to ask you to leave. They're water pipes.
- fuzz4lyfe 7y agoI like to consume my tobacco via a steamroller or gravity water pipe. So refreshing.
- vortico 7y agoTotally off-topic question to this thread, but what's the reason for being kicked out of those stores for saying "bong"? I would have guessed that as long as employees don't use the term, it's fine for the company for the customers to suggest what they'll actually be using it for.
- gduplessy 7y agoGoing to throw out a guess and say it's because selling you an item after you called it a bong is admitting that it's indeed a bong.
- vortico 7y agoAh, that makes sense, question answered. My second question is that if bongs and water pipes are the same thing, why does the law distinguish their purpose by their name? It seems like given "I want to buy a water pipe for smoking the marijuana" and "I want a bong to smoke tobacco", the second should be legal to request, not both.
- aSockPuppeteer 7y agoIt may be designed for a cut and run approach. For example, about to crash in enemy territory, brick all the computers.
- hutzlibu 7y agoOnly when supposed to do it stealthily. Otherwise there are faster military options, to destroy computers.
- Someone 7y agoIn that case, you want to do a lot more than brick it; you want to destroy disks, ROM, and in many cases even PCB boards. Explosives will destroy, but recognizable parts will survive. Your safest bet probably is burning your computer, fast and thoroughly. I think white phosphorous is a popular choice for this kind of thing because it’s relatively easy and safe to transport, store, and deploy (compared to, say, strong acids such as aqua regia)
- Jerry2 7y agoFrom that page: >Does not require batteries, can be be used an unlimited number of times. So how does it work? How can it recharge all those capacitors?
- crowbahr 7y agoI believe they charge from the port first then discharge back into the port they just charged from.
- deleted 7y ago[deleted]
- kosma 7y agoIt's not an ESD or a surge tester; the manufacturer doesn't even pay much attention to differentiate between the two. Surge testing is done with well-defined waveforms like 8/20us pulses of specific voltage; ESD testing is done by discharging a specific voltage from well-defined source like 150pF/330R. This one is simply advertised as "powerful", meaning it doesn't respect those specs. To elaborate: surge/ESD protection components work on the basis of thermally dissipating incoming energy that exceeds voltage threshold. They're specifically designed to clamp single, short, high-energy pulses - not repeated pulses or constant voltage. A TVS or MOV will overheat & explode if you subject it to DC higher than its breakdown voltage, or if you subject it to repetitive load - they're simply not designed & rated for that because it's not what happens in the real world. You just don't get repetitive lightning strikes or repetitive ESD discharges in real life, and they don't protect against that. TL;DR: With enough voltage & current you can fry anything and that's what the device does.
- pvaldes 7y agoMaybe could be handy to distroy terminator robots and inactivate war weapons in the future. Who knows?
- blackflame7000 7y agoOne thing is certain, they will have a USB port.