News for hackers. Stuff that matters.
Re:Former student destroys 59 university computers using USB... by acchow on Thursday April 18, 2019 @08:52PM (#19696142)
"-200VDC is discharged over the data lines of the host device. This charge/discharge cycle is repeated many times per second, until the USB Killer is removed"

Is there any device that is supposed to survive this?

In other news, throwing your computer in a fire also reveals a serious vulnerability.

Re:Former student destroys 59 university computers using USB... by jrockway on Friday April 19, 2019 @12:17AM (#19697062)
Ethernet will probably do fine. The differential pair ends in a transformer, so unless you pump so much current in that it physically melts the transformer or wire, you'll be fine. USB should be similar, but apparently is not. (In the case of the USB killer, the amount of time where 200V is applied to the circuit is probably very tiny. I imagine it's just a charge pump that charges a tiny capacitor and discharges it.)

Ethernet is designed this way because the differential pair can apparently pick up a bit of a DC bias when laid next to cables in the ceiling/wall. While researching this post, I found that the spec requires the transformer/inductor to work correctly with a 30mA bias current. I am too lazy to go measure what the DC resistance is, though, so I don't know whether or not 200V is close to that.

When I was in high school, I wired up a cat 5 cable such that each pair was connected to one phase of the mains. I then plugged it directly into my iMac. There was no damage to the computer and the Ethernet port worked fine afterwards as well. (The integrated monitor went crazy; this was in the CRT days and presumably the Ethernet transceiver's magnetics make a good degaussing coil).

Re:Former student destroys 59 university computers using USB... by brirec on Friday April 19, 2019 @02:02AM (#19697412)
Oh dear god, why did you connect your iMac’s Ethernet port to mains? Did you expect it to survive?!

The fact that Ethernet functions the same with a voltage bias across the leads is exploited for PoE — power over Ethernet.

Re:Former student destroys 59 university computers using USB... by jrockway on Friday April 19, 2019 @12:30PM (#19700841)
> Oh dear god, why did you connect your iMac’s Ethernet port to mains?

Because I was 15 and bored.

Re:Former student destroys 59 university computers using USB... by copperx on Friday April 19, 2019 @05:41PM (#19703256)
Wouldn't you be more bored if you found yourself without an iMac?
Re:Former student destroys 59 university computers using USB... by nostrademons on Friday April 19, 2019 @04:08AM (#19697865)
In college I stripped one end of an Ethernet cord and plugged it into household current. The other end I had hooked up to an old laptop I no longer wanted. The wire exploded, and the motherboard was fried. YMMV. Laptop was an old Sony Vaio c. 2001 vintage if it makes a difference.

(On the plus side, this made up for sleeping through that physics class where my professor did the exploding wires demo.)

Re:Former student destroys 59 university computers using USB... by ttsda on Friday April 19, 2019 @10:31AM (#19699920)
Household current is AC, the transformer will pass it through.
Re:Former student destroys 59 university computers using USB... by Dylan16807 on Friday April 19, 2019 @12:54AM (#19697189)
The transformer mainly protects you from a voltage difference between a twisted pair and ground. Much less so from voltage across a twisted pair. But saturation could help limit the current spike, at least.
Re:Former student destroys 59 university computers using USB... by jrockway on Friday April 19, 2019 @01:06AM (#19697230)
That makes sense. The pair shouldn't have a voltage on it, that's why it's a twisted pair.
Re:Former student destroys 59 university computers using USB... by interfixus on Friday April 19, 2019 @01:19AM (#19697272)
> Is there any device that is supposed to survive this?

There used to be...

As a boy - and this is many, many years ago - I once, ehm, accidentally connected the external speaker-plug on an old vacuum tube household radio to the 220V mains.

A very loud bang, and the house went dark. The radio, however, was fine, although with an interesting new tonal slant to everything.

Re:Former student destroys 59 university computers using USB... by chrisswanda on Friday April 19, 2019 @06:01AM (#19698249)
As a young man, I grabbed a 6146B tube before it discharged. I felt fine, until the pain started.
Re:Former student destroys 59 university computers using USB... by codedokode on Friday April 19, 2019 @08:26AM (#19698980)
Because radios in those days were made properly, without planned obsolescence!
Re:Former student destroys 59 university computers using USB... by klodolph on Friday April 19, 2019 @10:22AM (#19699831)
That's the filter of history at work. By and large, old radios were not built to last. The only ones that survive are the ones that, because of good design, good luck, or gentle use, managed to make it to today.

I repair & build vacuum tube equipment as a hobby.

Re:Former student destroys 59 university computers using USB... by mfgs on Thursday April 18, 2019 @09:57PM (#19696460)
You'd need opto-isolated data lines. I can't see any common devices having that.
Re:Former student destroys 59 university computers using USB... by egwynn on Thursday April 18, 2019 @11:45PM (#19696945)
For a while, macbooks were built this way: https://github.com/usbkill/community/wiki/Consumer-Laptop-Ha...
Re:Former student destroys 59 university computers using USB... by Razengan on Thursday April 18, 2019 @11:56PM (#19696991)
But the recent/2018 ones are vulnerable? Why? Cost cutting?
Re:Former student destroys 59 university computers using USB... by tjohns on Friday April 19, 2019 @01:23AM (#19697282)
Probably related to the switch to USB-C, which started with the 2016 models.
Re:Former student destroys 59 university computers using USB... by Johnny555 on Thursday April 18, 2019 @11:09PM (#19696817)
Would that even meet the USB spec? You could isolate the entire USB module, but I don't think you can just isolate the data lines.

And you'd still have to deal with the big spikes coming in on the USB power pins.

Re:Former student destroys 59 university computers using USB... by ShorsHammer on Thursday April 18, 2019 @10:40PM (#19696658)
Newer Apple devices should be protected.
Re:Former student destroys 59 university computers using USB... by SeanLuke on Thursday April 18, 2019 @11:36PM (#19696916)
Why?
Re:Former student destroys 59 university computers using USB... by egwynn on Thursday April 18, 2019 @11:44PM (#19696940)
For a time, macbooks had opto-isolated USB ports[0]. I think they don’t anymore though.

[0] https://github.com/usbkill/community/wiki/Consumer-Laptop-Ha...

Re:Former student destroys 59 university computers using USB... by SeanLuke on Friday April 19, 2019 @08:25AM (#19698968)
Call me highly skeptical. Every reference I've seen to this claim seems to point back to usbkill.com making it itself.

The problem is: optoisolators are very slow. Building one which goes faster than 12Mbps would be nontrivial; I do not think such a thing existed in 2014 (which usbkill is claiming). This implies that Apple has alien technology.

I think it's something else.

Re:Former student destroys 59 university computers using USB... by michaelt on Friday April 19, 2019 @09:11AM (#19699283)

  The problem is: optoisolators are very slow.
Many are but they don't have to be - an optoisolator is just a zero-length fiber optic cable. Ain't much higher bandwidth than a fiber optic cable.

Not saying apple laptops ever had optoisolated USB though.

Re:Former student destroys 59 university computers using USB... by mindslight on Friday April 19, 2019 @11:50AM (#19700510)
IMHO the problem with isolating USB is the 480Mbit ("USB 2.0") bidirectional signal.

12Mbps/1.5Mbps is easy. ADI has an integrated magnetic isolator chip. For hobbyist use you can get this assembled on a board ready to use as an ebay special.

The 5Gbit of USB3 is two unidirectional links and so is also easy (monoprice and elsewhere sell optical USB3 cables).

And lest you think you'll isolate at 5Gbit and then use a hub to translate to 480, USB3 doesn't work that way - the backwards compatibility is provided by a complete USB 2 bus in parallel.

For general isolating (say an electronics workbench), it's easiest to consider the USB host floating (eg a dedicated bench computer), and rely on ethernet (T or SX) for the isolation.

Re:Former student destroys 59 university computers using USB... by simias on Friday April 19, 2019 @09:50AM (#19699578)
Beyond that the host has to supply 5V to the USB device, couldn't you just cause some damage by sending 200V on these lines? You might only fry the USB power supply but that's enough to be a major pain.
Re:Former student destroys 59 university computers using USB... by mirimir on Friday April 19, 2019 @12:18AM (#19697068)
I vaguely recall the argument (maybe buried in the USBKill site) that manufacturers could ~easily limit maximum voltage across the data lines. Maybe using a resettable fuse? I know that Raspberry Pi limit USB input voltage to ~5V, for example.
Re:Former student destroys 59 university computers using USB... by miahi on Friday April 19, 2019 @01:12AM (#19697248)
Raspberry Pi limits the input voltage with a Zener diode across the input. In a Zener used this way, the current flow through the diode varies with the voltage difference between the input and the output - so with enough voltage input you can still make it fail, as you can exceed the max power dissipation of the diode and then it will burn - and after that, your circuit is not protected anymore.
Re:Former student destroys 59 university computers using USB... by blackflame7000 on Friday April 19, 2019 @09:16PM (#19704265)
I can confirm that you can indeed destroy an RPI0 by accidentally connecting a power supply to the USB port while another power supply is connected to the power supply port.
Re:Former student destroys 59 university computers using USB... by mirimir on Friday April 19, 2019 @11:25AM (#19700336)
OK, so is there any other purely electronic protection method? Or are optoisolators the only option?