The Telegraph reports the drive was created by a Russian security researcher known as “Dark Purple”. He demoed the device in a YouTube video in which his creation kills a laptop computer within seconds of being connected to the USB port.
The researcher hijacked the power delivery capabilities of USB to pull off the attack. When the drive is plugged in, it beings to draw power from the port which is then fed through an inverting DC to DC converter and used to charge up capacitors, electrical components capable of storing charge for later release.
The capacitors are fully charged within a few seconds of the stick being connected. A filled transistor then connects the circuit to the signal lines of the USB port, representing a direct connection to the motherboard as these lines are responsible for ferrying information between the computer and connected device.
The capacitor then discharges all the stored electricity in one go, sending a 220 volt pulse directly to the motherboard. The circuitry is immediately fried and the computer effectively destroyed.
Even if it somehow survives, it won’t last for long — the USB stick operates continuously until disconnected or it ends up killing the computer’s power supply. The motherboard will continue receiving 220V of power every few seconds until the drive is removed. The USB could take down any device with a powered USB port including phones, tablets, game consoles, Wi-Fi routers, smart devices, televisions and even cars via their diagnostic ports.
“Killer USB” represents a new form of hardware hijacking aimed firmly at destruction. Hackers using the device would be looking to abruptly end operations rather than steal sensitive data like passwords.
Although physical access to a machine would be required, attacks started with USB drives have been successful in the past. It was a USB stick that allowed the United States and Israel to unleash the Stuxnet worm onto the Fujitsu servers powering Iran’s nuclear program.
The killer stick could make it easier than ever for anyone with physical access to a computer to destroy it with almost no waiting time. The “good” news is that in most cases data on hard drives will not be lost as the death of the motherboard will isolate other hardware from the effects of the killer USB.
Even so, it could take server farms offline in seconds if hackers could gain inside access to a datacentre. As hard drives are being continually written to in a server environment, some data loss and corruption would be inevitable if the power was abruptly boosted by 220V and then killed.
