7 ms·

"-200VDC is discharged over the data lines of the host device. This charge/discharge cycle is repeated many times per second, until the USB Killer is removed"

by acchow 8y ago

"-200VDC is discharged over the data lines of the host device. This charge/discharge cycle is repeated many times per second, until the USB Killer is removed" Is there any device that is supposed to survive this? In other news, throwing your computer in a fire also reveals a serious vulnerability.

mfgs 8y ago
You'd need opto-isolated data lines. I can't see any common devices having that.
- ShorsHammer 8y ago
  Newer Apple devices should be protected.
  - SeanLuke 8y ago
    Why?
    - egwynn 8y ago
      For a time, macbooks had opto-isolated USB ports[0]. I think they don’t anymore though. [0] https://github.com/usbkill/community/wiki/Consumer-Laptop-Hardware https://github.com/usbkill/community/wiki/Consumer-Laptop-Ha...
      - SeanLuke 8y ago
        Call me highly skeptical. Every reference I've seen to this claim seems to point back to usbkill.com making it itself. The problem is: optoisolators are very slow. Building one which goes faster than 12Mbps would be nontrivial; I do not think such a thing existed in 2014 (which usbkill is claiming). This implies that Apple has alien technology. I think it's something else.
        michaelt 8y ago
        The problem is: optoisolators are very slow. Many are but they don't have to be - an optoisolator is just a zero-length fiber optic cable. Ain't much higher bandwidth than a fiber optic cable. Not saying apple laptops ever had optoisolated USB though.
        mindslight 8y ago
        IMHO the problem with isolating USB is the 480Mbit ("USB 2.0") bidirectional signal. 12Mbps/1.5Mbps is easy. ADI has an integrated magnetic isolator chip. For hobbyist use you can get this assembled on a board ready to use as an ebay special. The 5Gbit of USB3 is two unidirectional links and so is also easy (monoprice and elsewhere sell optical USB3 cables). And lest you think you'll isolate at 5Gbit and then use a hub to translate to 480, USB3 doesn't work that way - the backwards compatibility is provided by a complete USB 2 bus in parallel. For general isolating (say an electronics workbench), it's easiest to consider the USB host floating (eg a dedicated bench computer), and rely on ethernet (T or SX) for the isolation.
        simias 8y ago
        Beyond that the host has to supply 5V to the USB device, couldn't you just cause some damage by sending 200V on these lines? You might only fry the USB power supply but that's enough to be a major pain.
    - deleted 8y ago
      [deleted]
- Johnny555 8y ago
  Would that even meet the USB spec? You could isolate the entire USB module, but I don't think you can just isolate the data lines. And you'd still have to deal with the big spikes coming in on the USB power pins.
- egwynn 8y ago
  For a while, macbooks were built this way: https://github.com/usbkill/community/wiki/Consumer-Laptop-Hardware https://github.com/usbkill/community/wiki/Consumer-Laptop-Ha...
  - Razengan 8y ago
    But the recent/2018 ones are vulnerable? Why? Cost cutting?
    - tjohns 8y ago
      Probably related to the switch to USB-C, which started with the 2016 models.
jrockway 8y ago
Ethernet will probably do fine. The differential pair ends in a transformer, so unless you pump so much current in that it physically melts the transformer or wire, you'll be fine. USB should be similar, but apparently is not. (In the case of the USB killer, the amount of time where 200V is applied to the circuit is probably very tiny. I imagine it's just a charge pump that charges a tiny capacitor and discharges it.) Ethernet is designed this way because the differential pair can apparently pick up a bit of a DC bias when laid next to cables in the ceiling/wall. While researching this post, I found that the spec requires the transformer/inductor to work correctly with a 30mA bias current. I am too lazy to go measure what the DC resistance is, though, so I don't know whether or not 200V is close to that. When I was in high school, I wired up a cat 5 cable such that each pair was connected to one phase of the mains. I then plugged it directly into my iMac. There was no damage to the computer and the Ethernet port worked fine afterwards as well. (The integrated monitor went crazy; this was in the CRT days and presumably the Ethernet transceiver's magnetics make a good degaussing coil).
- Dylan16807 8y ago
  The transformer mainly protects you from a voltage difference between a twisted pair and ground. Much less so from voltage across a twisted pair. But saturation could help limit the current spike, at least.
  - jrockway 8y ago
    That makes sense. The pair shouldn't have a voltage on it, that's why it's a twisted pair.
- brirec 8y ago
  Oh dear god, why did you connect your iMac’s Ethernet port to mains? Did you expect it to survive?! The fact that Ethernet functions the same with a voltage bias across the leads is exploited for PoE — power over Ethernet.
  - jrockway 8y ago
mirimir 8y ago
I vaguely recall the argument (maybe buried in the USBKill site) that manufacturers could ~easily limit maximum voltage across the data lines. Maybe using a resettable fuse? I know that Raspberry Pi limit USB input voltage to ~5V, for example.
- miahi 8y ago
  Raspberry Pi limits the input voltage with a Zener diode across the input. In a Zener used this way, the current flow through the diode varies with the voltage difference between the input and the output - so with enough voltage input you can still make it fail, as you can exceed the max power dissipation of the diode and then it will burn - and after that, your circuit is not protected anymore.
  - mirimir 8y ago
    OK, so is there any other purely electronic protection method? Or are optoisolators the only option?
  - blackflame7000 8y ago
    I can confirm that you can indeed destroy an RPI0 by accidentally connecting a power supply to the USB port while another power supply is connected to the power supply port.
interfixus 8y ago
> Is there any device that is supposed to survive this? There used to be... As a boy - and this is many, many years ago - I once, ehm, accidentally connected the external speaker-plug on an old vacuum tube household radio to the 220V mains. A very loud bang, and the house went dark. The radio, however, was fine, although with an interesting new tonal slant to everything.
- chrisswanda 8y ago
  As a young man, I grabbed a 6146B tube before it discharged. I felt fine, until the pain started.
- codedokode 8y ago
  Because radios in those days were made properly, without planned obsolescence!
  - klodolph 8y ago
    That's the filter of history at work. By and large, old radios were not built to last. The only ones that survive are the ones that, because of good design, good luck, or gentle use, managed to make it to today. I repair & build vacuum tube equipment as a hobby.

by acchow 8y ago

mfgs 8y ago

You'd need opto-isolated data lines. I can't see any common devices having that.

ShorsHammer 8y ago
Newer Apple devices should be protected.
- SeanLuke 8y ago
  Why?
  - egwynn 8y ago
    For a time, macbooks had opto-isolated USB ports[0]. I think they don’t anymore though. [0] https://github.com/usbkill/community/wiki/Consumer-Laptop-Hardware https://github.com/usbkill/community/wiki/Consumer-Laptop-Ha...
    - SeanLuke 8y ago
      Call me highly skeptical. Every reference I've seen to this claim seems to point back to usbkill.com making it itself. The problem is: optoisolators are very slow. Building one which goes faster than 12Mbps would be nontrivial; I do not think such a thing existed in 2014 (which usbkill is claiming). This implies that Apple has alien technology. I think it's something else.
      - michaelt 8y ago
        The problem is: optoisolators are very slow. Many are but they don't have to be - an optoisolator is just a zero-length fiber optic cable. Ain't much higher bandwidth than a fiber optic cable. Not saying apple laptops ever had optoisolated USB though.
        mindslight 8y ago
        IMHO the problem with isolating USB is the 480Mbit ("USB 2.0") bidirectional signal. 12Mbps/1.5Mbps is easy. ADI has an integrated magnetic isolator chip. For hobbyist use you can get this assembled on a board ready to use as an ebay special. The 5Gbit of USB3 is two unidirectional links and so is also easy (monoprice and elsewhere sell optical USB3 cables). And lest you think you'll isolate at 5Gbit and then use a hub to translate to 480, USB3 doesn't work that way - the backwards compatibility is provided by a complete USB 2 bus in parallel. For general isolating (say an electronics workbench), it's easiest to consider the USB host floating (eg a dedicated bench computer), and rely on ethernet (T or SX) for the isolation.
      - simias 8y ago
        Beyond that the host has to supply 5V to the USB device, couldn't you just cause some damage by sending 200V on these lines? You might only fry the USB power supply but that's enough to be a major pain.
  - deleted 8y ago
    [deleted]
Johnny555 8y ago
Would that even meet the USB spec? You could isolate the entire USB module, but I don't think you can just isolate the data lines. And you'd still have to deal with the big spikes coming in on the USB power pins.
egwynn 8y ago
For a while, macbooks were built this way: https://github.com/usbkill/community/wiki/Consumer-Laptop-Hardware https://github.com/usbkill/community/wiki/Consumer-Laptop-Ha...
- Razengan 8y ago
  But the recent/2018 ones are vulnerable? Why? Cost cutting?
  - tjohns 8y ago
    Probably related to the switch to USB-C, which started with the 2016 models.

jrockway 8y ago

Ethernet will probably do fine. The differential pair ends in a transformer, so unless you pump so much current in that it physically melts the transformer or wire, you'll be fine. USB should be similar, but apparently is not. (In the case of the USB killer, the amount of time where 200V is applied to the circuit is probably very tiny. I imagine it's just a charge pump that charges a tiny capacitor and discharges it.) Ethernet is designed this way because the differential pair can apparently pick up a bit of a DC bias when laid next to cables in the ceiling/wall. While researching this post, I found that the spec requires the transformer/inductor to work correctly with a 30mA bias current. I am too lazy to go measure what the DC resistance is, though, so I don't know whether or not 200V is close to that. When I was in high school, I wired up a cat 5 cable such that each pair was connected to one phase of the mains. I then plugged it directly into my iMac. There was no damage to the computer and the Ethernet port worked fine afterwards as well. (The integrated monitor went crazy; this was in the CRT days and presumably the Ethernet transceiver's magnetics make a good degaussing coil).

Dylan16807 8y ago
The transformer mainly protects you from a voltage difference between a twisted pair and ground. Much less so from voltage across a twisted pair. But saturation could help limit the current spike, at least.
- jrockway 8y ago
  That makes sense. The pair shouldn't have a voltage on it, that's why it's a twisted pair.
brirec 8y ago
Oh dear god, why did you connect your iMac’s Ethernet port to mains? Did you expect it to survive?! The fact that Ethernet functions the same with a voltage bias across the leads is exploited for PoE — power over Ethernet.
- jrockway 8y ago

mirimir 8y ago

I vaguely recall the argument (maybe buried in the USBKill site) that manufacturers could ~easily limit maximum voltage across the data lines. Maybe using a resettable fuse? I know that Raspberry Pi limit USB input voltage to ~5V, for example.

miahi 8y ago
Raspberry Pi limits the input voltage with a Zener diode across the input. In a Zener used this way, the current flow through the diode varies with the voltage difference between the input and the output - so with enough voltage input you can still make it fail, as you can exceed the max power dissipation of the diode and then it will burn - and after that, your circuit is not protected anymore.
- mirimir 8y ago
  OK, so is there any other purely electronic protection method? Or are optoisolators the only option?
- blackflame7000 8y ago
  I can confirm that you can indeed destroy an RPI0 by accidentally connecting a power supply to the USB port while another power supply is connected to the power supply port.

interfixus 8y ago

> Is there any device that is supposed to survive this? There used to be... As a boy - and this is many, many years ago - I once, ehm, accidentally connected the external speaker-plug on an old vacuum tube household radio to the 220V mains. A very loud bang, and the house went dark. The radio, however, was fine, although with an interesting new tonal slant to everything.

chrisswanda 8y ago
As a young man, I grabbed a 6146B tube before it discharged. I felt fine, until the pain started.
codedokode 8y ago
Because radios in those days were made properly, without planned obsolescence!
- klodolph 8y ago
  That's the filter of history at work. By and large, old radios were not built to last. The only ones that survive are the ones that, because of good design, good luck, or gentle use, managed to make it to today. I repair & build vacuum tube equipment as a hobby.