4 ms·

> you can straight up fry a computer with a flash drive that has been tampered with. USB in general doesn't really seem to be designed with security in mind. I

> you can straight up fry a computer with a flash drive that has been tampered with. USB in general doesn't really seem to be designed with security in mind. I don't think it's fair to claim USB is insecure because you can buy accessories that charge a capacitor bank over the 5V, and then feed that back to the computer. That could be solved by using an isolated hub to host USB devices, like the Spectra 3022. Then again, if you have equipment that expensive, I hope you're not plugging random stuff into it...

temp0826 2y ago
I wonder if there's a market for USB hubs with breakers/fuses to protect against this. Probably only security researchers plugging in known-sketchy things though.
- tentacleuno 2y ago
  The thing is, adding an inline fuse doesn't guarantee that the host would be safe: if the fuse doesn't blow quick enough and lets enough current through, that's bad (plus, you'd have to add a fuse to P-, D+, D- and P+ just to be sure, not to mention USB3). The best option would probably be a complete isolation of the USB device from the host, with a hub that then transfers D- and D+ to the host without a direct electrical connection (while providing its own P- and P+). Think TOSlink, but for USB.
  - utensil4778 2y ago
    Galvanic USB isolators are a thing. Mostly for medical applications, but it's literally a chip you can buy off the shelf that provides total electrical isolation (with the addition of an isolated 5v supply).
  - 6SixTy 2y ago
    There are digital isolator ICs, like ADUM3166 from Analog Devices, though like none of them are for USB 3.0+ Awful lot of isolation transformers in the IC diagram, so I'm sure that something like the transformers used for Ethernet could be reused to protect basically any USB ports from a USB killer attack, though they are awfully big for a smartphone
  - cartoonfoxes 2y ago
    The industrial hubs I'm familar with use optoisolators to separate the host and attached devices, I think. Advantech has a USB-3 version (P/N USB-4630), but I can't speak to these personally.
- cartoonfoxes 2y ago
  Absolutley. In a hardware-development context, we use them to stop frying computers with broken devices. I've had good experience with the BB-UHR304 from Advantech. They're expensive and occasionally sacrificial, but cheaper than replacing an average pc / laptop. https://www.advantech.com/en/products/c9300564-0829-46eb-955c-0953dc5e757b/bb-uhr304/mod_a225fa90-fd2b-4a9c-8dfa-6192876974b7 https://www.advantech.com/en/products/c9300564-0829-46eb-955...

temp0826 2y ago

I wonder if there's a market for USB hubs with breakers/fuses to protect against this. Probably only security researchers plugging in known-sketchy things though.

tentacleuno 2y ago
The thing is, adding an inline fuse doesn't guarantee that the host would be safe: if the fuse doesn't blow quick enough and lets enough current through, that's bad (plus, you'd have to add a fuse to P-, D+, D- and P+ just to be sure, not to mention USB3). The best option would probably be a complete isolation of the USB device from the host, with a hub that then transfers D- and D+ to the host without a direct electrical connection (while providing its own P- and P+). Think TOSlink, but for USB.
- utensil4778 2y ago
  Galvanic USB isolators are a thing. Mostly for medical applications, but it's literally a chip you can buy off the shelf that provides total electrical isolation (with the addition of an isolated 5v supply).
- 6SixTy 2y ago
  There are digital isolator ICs, like ADUM3166 from Analog Devices, though like none of them are for USB 3.0+ Awful lot of isolation transformers in the IC diagram, so I'm sure that something like the transformers used for Ethernet could be reused to protect basically any USB ports from a USB killer attack, though they are awfully big for a smartphone
- cartoonfoxes 2y ago
  The industrial hubs I'm familar with use optoisolators to separate the host and attached devices, I think. Advantech has a USB-3 version (P/N USB-4630), but I can't speak to these personally.
cartoonfoxes 2y ago
Absolutley. In a hardware-development context, we use them to stop frying computers with broken devices. I've had good experience with the BB-UHR304 from Advantech. They're expensive and occasionally sacrificial, but cheaper than replacing an average pc / laptop. https://www.advantech.com/en/products/c9300564-0829-46eb-955c-0953dc5e757b/bb-uhr304/mod_a225fa90-fd2b-4a9c-8dfa-6192876974b7 https://www.advantech.com/en/products/c9300564-0829-46eb-955...