Former student destroys 59 university computers using USB Killer device

https://www.zdnet.com/article/former-student-destroys-59-university-computers-using-usb-killer-device/

by edward • 7 years ago

160 206 7 years ago

zdnet.com

mariuolo• 7 years ago

How do you obtain a MBA while being so stupid?

scotty79• 7 years ago

Knowledge and stupidity are multidimensional and orthogonal.

joezydeco• 7 years ago

You need to meet more MBA graduates. The stupidity ratio will astound you.

acchow2• 7 years ago

What do you think the qualifications for an MBA are?

nixgeek• 7 years ago

Ability to pay the tuition fees.

stadeschuldt2• 7 years ago

I am looking at https://usbkill.com/. What is the purpose of the device? The manufacturer calls it an "ESD tester" yet there is an "anonymous" version available: https://usbkill.com/products/usb-killer-v3?variant=447760856...

yial• 7 years ago

They bill it for “pen testers and police” so I would guess it’s really for people who imagine themselves / want to be within that audience. Not to be overly cynical.

I suppose some pen testers, or actual CIA type folks might have some need of this type of device... but is that a large enough market?

stadeschuldt2• 7 years ago

I don't buy the pen testing part. I might as well sell a hammer and call it a pen testing device. Funny enough they have the following on their website:

"A hammer used maliciously can permanently damage to a third party's device. The USB Killer, used maliciously, can permanently damage a third party's device."

Contrary to this device a hammer can be used a useful tool too.

moftz• 7 years ago

I can't even imagine a situation where police would want to destroy a running device that could likely have evidence stored in volatile memory. Even if it was their own device that they were retiring, it doesn't even wipe data, it just destroys the logic/motherboard.

Hardware designers might want one to test out their mitigation circuit but once your design, why do you need a USBkill anymore?

This thing just seems like a destructive version of those annoyance toys like a TV-B-Gone.

8note• 7 years ago

I could see this being used to check USB chargers to make sure they don't catch fire when weird things happen

secfirstmd2• 7 years ago

Also activists / journos in some countries. I know we have looked at various emergency destruction techniques over the years.

neaanopri• 7 years ago

I mean, it's not like it's expensive to manufacture! One person soldering and maybe a single board and usb plug, its probably easy to make money if you can sell them for $30 or so in the volumes of 100's.

wodenokoto2• 7 years ago

Is the device safe? The USB Kill and the USB Kill Testing Shield are safe to use. Both devices have been manufactured, tested and certified as CE Approved. Test in complete confidence.

This device that is designed to destroy computers is perfectly safe to use ... I don't know what to say to that.

0-_-0• 7 years ago

Safe for the user, not to the computer I assume.

londons_explore5• 7 years ago

I kinda doubt that. If you unplug it while in use and stick a key into the USB plug, you might get a painful surprise...

anonlastname• 7 years ago

I could see it being useful for when you want an easy way to get a high voltage spike out of a 5v power supply. For example, if you wanted to build a board for igniting the gas in a potato gun that ran off of a USB power bank.

TeMPOraL• 7 years ago

Speaking of power banks, what would happen if you plugged this device directly to one?

semi-extrinsic• 7 years ago

Then you want something like one of these instead:

https://www.ebay.com/itm/DC-3V-5V-Arc-Generator-High-Voltage...

You also want to use the gas dispenser from a Paslode impact gun, an air mattress inflator and a Zodiac check valve for the air purge.

acchow2• 7 years ago

"-200VDC is discharged over the data lines of the host device. This charge/discharge cycle is repeated many times per second, until the USB Killer is removed"

Is there any device that is supposed to survive this?

In other news, throwing your computer in a fire also reveals a serious vulnerability.

mfgs• 7 years ago

You'd need opto-isolated data lines. I can't see any common devices having that.

jrockway3• 7 years ago

Ethernet will probably do fine. The differential pair ends in a transformer, so unless you pump so much current in that it physically melts the transformer or wire, you'll be fine. USB should be similar, but apparently is not. (In the case of the USB killer, the amount of time where 200V is applied to the circuit is probably very tiny. I imagine it's just a charge pump that charges a tiny capacitor and discharges it.)

Ethernet is designed this way because the differential pair can apparently pick up a bit of a DC bias when laid next to cables in the ceiling/wall. While researching this post, I found that the spec requires the transformer/inductor to work correctly with a 30mA bias current. I am too lazy to go measure what the DC resistance is, though, so I don't know whether or not 200V is close to that.

When I was in high school, I wired up a cat 5 cable such that each pair was connected to one phase of the mains. I then plugged it directly into my iMac. There was no damage to the computer and the Ethernet port worked fine afterwards as well. (The integrated monitor went crazy; this was in the CRT days and presumably the Ethernet transceiver's magnetics make a good degaussing coil).

mirimir2• 7 years ago

I vaguely recall the argument (maybe buried in the USBKill site) that manufacturers could ~easily limit maximum voltage across the data lines. Maybe using a resettable fuse? I know that Raspberry Pi limit USB input voltage to ~5V, for example.

interfixus• 7 years ago

Is there any device that is supposed to survive this?

There used to be...

As a boy - and this is many, many years ago - I once, ehm, accidentally connected the external speaker-plug on an old vacuum tube household radio to the 220V mains.

A very loud bang, and the house went dark. The radio, however, was fine, although with an interesting new tonal slant to everything.

gruez3• 7 years ago

The manufacturer calls it an "ESD tester" yet there is an "anonymous" version available

plausible deniability. selling devices specifically for committing crimes is illegal. that's why all the bong shops say it's "for tobacco use only".

cronix• 7 years ago

that's why all the bong shops say it's "for tobacco use only"

Unless you're in a state that's legalized it.

subway• 7 years ago

If you use that word again, we'll have to ask you to leave. They're water pipes.

ProblemFactory• 7 years ago

plausible deniability.

Why would that be necessary?

Jackhammers are tools to destroy pavement. But nobody sells jackhammers as "ground strength testing tools".

These are tools to destroy computers. Both are completely legal as long as you are not destroying someone else's property without permission.

aSockPuppeteer• 7 years ago

It may be designed for a cut and run approach. For example, about to crash in enemy territory, brick all the computers.

hutzlibu• 7 years ago

Only when supposed to do it stealthily. Otherwise there are faster military options, to destroy computers.

Someone• 7 years ago

In that case, you want to do a lot more than brick it; you want to destroy disks, ROM, and in many cases even PCB boards.

Explosives will destroy, but recognizable parts will survive. Your safest bet probably is burning your computer, fast and thoroughly.

I think white phosphorous is a popular choice for this kind of thing because it’s relatively easy and safe to transport, store, and deploy (compared to, say, strong acids such as aqua regia)

Jerry2• 7 years ago

From that page:

Does not require batteries, can be be used an unlimited number of times.

So how does it work? How can it recharge all those capacitors?

crowbahr• 7 years ago

I believe they charge from the port first then discharge back into the port they just charged from.

kosma• 7 years ago

It's not an ESD or a surge tester; the manufacturer doesn't even pay much attention to differentiate between the two. Surge testing is done with well-defined waveforms like 8/20us pulses of specific voltage; ESD testing is done by discharging a specific voltage from well-defined source like 150pF/330R. This one is simply advertised as "powerful", meaning it doesn't respect those specs.

To elaborate: surge/ESD protection components work on the basis of thermally dissipating incoming energy that exceeds voltage threshold. They're specifically designed to clamp single, short, high-energy pulses - not repeated pulses or constant voltage. A TVS or MOV will overheat & explode if you subject it to DC higher than its breakdown voltage, or if you subject it to repetitive load - they're simply not designed & rated for that because it's not what happens in the real world. You just don't get repetitive lightning strikes or repetitive ESD discharges in real life, and they don't protect against that.

TL;DR: With enough voltage & current you can fry anything and that's what the device does.

pvaldes2• 7 years ago

Maybe could be handy to distroy terminator robots and inactivate war weapons in the future. Who knows?

blackflame70003• 7 years ago

One thing is certain, they will have a USB port.

wodenokoto2• 7 years ago

Any word on motive?

hprotagonist4• 7 years ago

February-ish is normally acceptance letter time, but it doesn't make sense. He'd already graduated, and nobody get an MBA and then applies for further graduate study.

gruez3• 7 years ago

Maybe he got a MBA, failed to get a job, then tried to reenroll, and got denied?

Buge• 7 years ago

It was on Valentine's day. I wonder if that has anything to do with it.

gruez3• 7 years ago

Maybe for the lulz/attention? The pdf says that he recorded himself doing it with his phone.

hprotagonist4• 7 years ago

Long ago, I worked for my uni's departmental IT group.

We made our own etherkiller, hung it on the wall with a sign "USE IN CASE OF SUN".

Never used it in anger, but it was fun to dream about...

mackal• 7 years ago

In one class we we're building a custom circuit to talk to a custom 8-bit computer over the ISA bus. I accidentally put one chip upside down (it was some off brand and I mistook a scuff on one end for the marker for which way is up) and killed the DOS PC :P

The custom 8-bit computer was fine though.

Gibbon12• 7 years ago

Classic was inserting an old 16k DRAM backwards.

Hmm... something smells hot... touch touch touch sound of screaming

jwilk• 7 years ago

USE IN CASE OF SUN

What does it mean?

vortico4• 7 years ago

Sun Microsystems maybe?

chronolitus• 7 years ago

Could imply that should it be sunny outside, the etherkiller allows creating an outage which leads to taking the day off?

hprotagonist4• 7 years ago

We had made an ill-considered deal with Sun Microsystems for a bunch of workstations maybe 18 months before they went away for good.

The machines were badly laid out, poorly specced, and prone to annoying failures.

They deserved, but did not receive, mains power right to the ethernet port.

colorincorrect• 7 years ago

Can someone tell me what would happen if you plug this onto a USB charger via an adaptor that is plugged to 220V AC?

wl• 7 years ago

Quite possibly nothing. A USB charger following the USB Battery Charging Specification has a resistor < 200Ω across D+ and D-. Just putting -200 V on D- and doing nothing to D+, there's not a completed circuit. If the charger uses the data lines for anything (e.g. Apple devices), perhaps it'd burn out whatever microcontroller is running things in the charger.

Causality1• 7 years ago

I completely understand the desire to do this. Universities do things that make you want to obliterate them with a meteor. What I don't understand is recording yourself committing a crime.

tyingq2• 7 years ago

College of St Rose lists their tuition as $29,826/yr. So he did about 2 tuition years of damage.

I wonder if he was worked up about student loan debt.

1024core4• 7 years ago

I'm guessing he's a rich kid from India, with rich parents who are bankrolling his education.

I hope he gets the full 10 years. Nothing like the US Penitentiary System to teach you a lesson.

wetpaws• 7 years ago

It's just a piece of plastic. Very intricate, relatively expensive silly plastic.

You are demanding blood and to trade off a huge chunk of human life for the silly piece of machinery (which he gonna pay fore anyway), are you feeling well, my friend?

sp0rk• 7 years ago

I'm guessing he's a rich kid from India, with rich parents who are bankrolling his education.

What is this guess based on?

gridlockd• 7 years ago

I hope he gets the full 10 years.

Ten years for vandalism? That's injustice.

You don't even know why he did it. Perhaps he was just an idiot, perhaps he had a legitimate grievance that he didn't know how to "rectify" otherwise.

Nothing like the US Penitentiary System to teach you a lesson.

Oh really? Then why does the US system have one of the highest rates of recidivism in the world? Why does the US have the highest incarceration rate in the world, perhaps with the exception of North Korea?

Dylan168072• 7 years ago

I'm curious how the damage breaks down, because it sounds like a lot of that damage might have been him destroying just a motherboard and then the entire computer being written off.

tjohns2• 7 years ago

Corporate/university IT shops don't normally do component-level replacement. Both due to time constraints and the nature of their support contacts.

(Assuming the Dell/HP/etc. workstations they bought even take standard size motherboards. I've seen some that don't.)

morpheuskafka• 7 years ago

The USB killer isn't really needed if your going to do it yourself and leave evidence. The use case would be to give it to someone else, or do it once in a reasonable manner and claim ignorance.

_xerxes_• 7 years ago

*You're

tyingq2• 7 years ago

The school did a Q&A with him on FB, apparently long before the incident: https://facebook.com/saintrosegrad/posts/10154835183318203

flashman• 7 years ago

how long before it disappears

a while: http://web.archive.org/web/20190419041118/https://m.facebook...

laretluval• 7 years ago

Almost enough.

everyone2• 7 years ago

Someone brought this up in an older thread about this device.. Why use this? You could just use a hammer, or pour water into them. It seems bizarre that he paid money for this device when there are many completely free ways to trash a pc.

ascorbic• 7 years ago

I assume someone would notice if he started smashing up computers with a hammer. No way he'd be able to destroy as many.

vonseel• 7 years ago

I imagine it’s much easier psychologically for a vandal to do this than anything obvious with a hammer or water. Also, you would think he’d probably get caught after the first or second monitor if he walked into a library and started smashing shit.

everyone2• 7 years ago

Yeah good points, I guess it is fairly discreet + also its novel so most people may not cog what hes doing very quickly. Is there not a pretty intense burning smell from the fried components though? .. So, its extremely situational. Use when you want to trash some running pc's in an occupied public area and not have people notice immediately maybe.

rhn_mk14• 7 years ago

Why can vandalism result in a prison term? I'd expect paying damages is a sufficient punishment for stupidity. Genuinely curious why the consequences are structured this way.

Hydraulix9892• 7 years ago

Deterrence. To some, the damages are pocket change.

tluyben26• 7 years ago

When we (Dutch) ask in school why our sentences are so low, it is explained that if the punishment does not fit the crime, you will be incentivized to add more crime because you are already facing prison time, so why would you care about a few years more or less. Aka if the crime for rape is almost the same as murder you might as well kill the victim to have less chance of being caught. We have not a lot of crime and people who commit crimes like this come out of it as long term productive citizens: if you go to jail, what exactly are you doing/deterring? He will never have a normal life because of some stupid thing he did? Do like (i think) scandinavia and swiss; make fines fit the economical status of the perpetrator.

Edit; me and my friends did dumb things when young, not quite this dumb, but enough, if tried as adult, for prison time in the US possibly and caning+prison in for instance Singapore ; what exactly would that have done? We are all highly successful tax payers and it was foolishness that occured once or twice, 30 years ago.

rhn_mk14• 7 years ago

I see the point, but the amounts described in the article are going to deter 99% of society already, so I find focusing on the 1% implausible. Is there anything I can read about such deterrence?

bdowling2• 7 years ago

I’ll add that deterrence breaks down into two different prongs: (1) deterring this particular guy from doing the same thing again and (2) deterring others from copying what this guy did. It might seem unfair to punish this guy harshly when a lesser punishment would deter him from ever trying the same thing again, but that is ignoring prong (2), the value of punishing him as a warning to others.

gerbilly• 7 years ago

FTFY: Revenge.

Prison certainly didn't seem to deter this guy, nor does the death penalty deter murderers.

http://www.deathpenaltyinfo.org/files/DeterrenceStudy2009.pd...

londons_explore5• 7 years ago

The damages are simply too small.

If the damages included the cost of the investigation, the impact of being without computers for months, etc. then the school wouldn't mind the incident happening again and again.

robertAngst• 7 years ago

Is prison going to make this person better?

vincnetas• 7 years ago

"According to the Vera Institute of Justice, incarceration costs an average of more than $31,000 per inmate, per year"

  damages: 60k
  fine: 250k
  price to incarcerate him for 10 years : 310K
  ...
  ... profit?

sdfsdfsdfsdf32• 7 years ago

Most decent (read: non-american) long haul airlines and even some 737 have USB sockets at each seat for charging devices, what effect would this have in the air?

alexcnwy• 7 years ago

good question! I have wondered about this when plugging my phone in and being asked “do you trust this computer?”

bukka3• 7 years ago

All Inflight Entertainment Systems are completely isolated. You'll fry your own screen, enjoy the rest of your flight.

sdfsdfsdfsdf32• 7 years ago

Woudln't that be a fire harzard?

bukka3• 7 years ago

The device was bought on a website that advertises it as an "ESD tester". Couldn't the student blame this on false advertising?

talonx• 7 years ago

And then he tested it on 59 different computers, just to make sure it works?

agumonkey• 7 years ago

there used to be a thing called usb condom https://duckduckgo.com/?q=usb+condom&atb=v119-3__&ia=web

to cut data lines altogether IIRC

I guess we need a new kind of condom with all lines protected for surges

ps: there are also these https://www.alibaba.com/countrysearch/CN/usb+isolation+modul...

Rudi9719• 7 years ago

Where did he think that was a good idea?

pvaldes2• 7 years ago

Wannabe criminals are getting dumber day by day. Is a fact.

Fifty years ago the idea of doing something ilegal whereas filming yourself smiling to your own camera, would tag you as martian. Currently all is like: look at me; I'm badass!! I'm a malote!! I want to rub shoulders with the bad guys!!. Hem... Nope, you are an idiot.

mosselman• 7 years ago

"He faces up to ten years in prison, a fine of up to $250,000"

That is crazy. He is obviously not completely 100% in the head and needs psychological help not imprisonment.

golergka• 7 years ago

Isn't such decision supposed to be a court ruling? I don't think that persecution can suggest psychological help in US court system.

binarymax2• 7 years ago

I think you meant to say prosecution. But persecution sounds fitting here because exactly the problem you state: mental health needs more awareness and application for people who suffer from these problems. Putting them in jail is the worst thing for everyone.

skazka16• 7 years ago

Wow!! I was the one who not intentionally popularized USB Killer. It happened 4 years ago. I owned a website, where I published translations of articles and one of them was about USB Killer. The article[1] was #1 on Hacker News[2] for several hours and made it viral on all major online publications. What I saw next was crazy. People around the world started to experiment trying to re-create the device - youtube videos, articles, blog posts, etc. I received a ton of mails with clarifying questions about the circuit board and so on, but I had zero clue how it all worked, since I simply translated the original[3] article from Russian. And then someone finally recreated this USB and the whole thing became a little market. Niche websites started to sell it and the device was a lucrative product for youtube kids to make their videos more fun. Wow..

[1] https://kukuruku.co/post/usb-killer/ [2] https://news.ycombinator.com/item?id=9176195 [3] https://habr.com/en/post/251451/

codedokode6• 7 years ago

Maybe the student thought that it was a normal flash drive and tried to find a working computer that can open it?

Also, isn't ten years too much for just destroying a property? It's not like anyone got hurt.

dsfyu404ed• 7 years ago

Also, isn't ten years too much for just destroying a property? It's not like anyone got hurt.

The (unspoken) point is to send a message of deterrence. Be a thorn in the side of important institutions and they will screw you hard.

ttsda2• 7 years ago

From the article:

"I'm going to kill this guy," "it's dead," and "it's gone. Boom," Akuthota said on recordings obtained by the prosecution.

roel_v• 7 years ago

What is a "computer-enhanced podium"? Why would I ever plug a usb stick into a podium?

codedokode6• 7 years ago

Because it has an USB socket.

thejrk_• 7 years ago

We have some. They are podium's that have built-in computers or some just have touch monitors and you supply the computer. They all have USB extensions so you don't have to dick around behind the thing to plug USB in.

binarymax2• 7 years ago

Likely just a podium with a dedicated laptop already connected to and optimized for the A/V system. Allows you to put a powerpoint on a USB and stick it into the machine and present from that, rather than messing with dongles and cords and A/V compatibility.

virtuexru• 7 years ago

According to court documents obtained by ZDNet, and the suspect, Vishwanath Akuthota, 27, filmed himself while destroying some of the computers.

Never understood why people film their own crimes?

vraivroo2• 7 years ago

To show their shitbird criminal buddies and giggle over?

Simulacra• 7 years ago

Some people are issued devices like these by their employers…

Former student destroys 59 university computers using USB Killer device

Related Stories