Former student destroys 59 university computers using USB Killer device | Hacker News Reader

Former student destroys 59 university computers using USB Killer device

zdnet.com

160 pointsedward213 comments

Wow!! I was the one who not intentionally popularized USB Killer. It happened 4 years ago. I owned a website, where I published translations of articles and one of them was about USB Killer. The article[1] was #1 on Hacker News[2] for several hours and made it viral on all major online publications. What I saw next was crazy. People around the world started to experiment trying to re-create the device - youtube videos, articles, blog posts, etc. I received a ton of mails with clarifying questions about the circuit board and so on, but I had zero clue how it all worked, since I simply translated the original[3] article from Russian. And then someone finally recreated this USB and the whole thing became a little market. Niche websites started to sell it and the device was a lucrative product for youtube kids to make their videos more fun. Wow..

[1] https://kukuruku.co/post/usb-killer/ [2] https://news.ycombinator.com/item?id=9176195 [3] https://habr.com/en/post/251451/

I am looking at https://usbkill.com/. What is the purpose of the device? The manufacturer calls it an "ESD tester" yet there is an "anonymous" version available: https://usbkill.com/products/usb-killer-v3?variant=447760856...

They bill it for “pen testers and police” so I would guess it’s really for people who imagine themselves / want to be within that audience. Not to be overly cynical.

I suppose some pen testers, or actual CIA type folks might have some need of this type of device... but is that a large enough market?

I don't buy the pen testing part. I might as well sell a hammer and call it a pen testing device. Funny enough they have the following on their website:

"A hammer used maliciously can permanently damage to a third party's device. The USB Killer, used maliciously, can permanently damage a third party's device."

Contrary to this device a hammer can be used a useful tool too.

It's designed to prove a point.

To prove that USB devices can be malicious.

It's probably most useful as an education tool, training staff not to plug random USB devices they find lying around the parking lot into their computers.

I would think a USB containing an info graphic about the dangers of plugging in random USBs is a far more efficient education tool than one that destroys the hardware of your staff. Worse, what if they took it home and used it on a personal device?

>> training staff not to plug random USB devices...

Nothing like some high-consequences IRL training!

Perhaps curricula for the Inspector Clouseau police academy?

It's like hiring a gunman to start shooting up your office to train people about the dangers of social engineering, to prove that some people shouldn't be trusted.

Bad choice as an example of social engineering, not funny, and doesn’t make sense at all.

I don't think that it was a joke or made in bad faith - rather to demonstrate the logical extreme.

Essentially that the logical extreme of dropping computer-destroying USBs to demonstrate that one shouldn't plug strange USBs in the first place is akin to destroying an office that you talked yourself into to prove that you shouldn't have been let in in the first place. Perhaps "shooting up" was a tad too far, but with charity it's a reasonable point nonetheless.

Right, it wasn't supposed to be a joke, and the intended argument was that hiring a gunman as social engineering training makes as much sense as using a computer-destroying USB stick as physical security training—so yes, it was supposed to be a bad example of social engineering.

Using a computer-destroying USB stick as an example of physical security threats misunderstands the nature and motivations of attackers. Everyone past childhood (and some in childhood, sadly) understands that there are a few people in this world whose motivation is to cause destruction and hurt simply because they find destruction and hurt enjoyable in themselves. They also understand that such people are rare, and that their threat modeling (which everyone does, even if they don't call it that) should rationally respond to such people by almost ignoring them—otherwise you find yourself not leaving your house for fear that there's a gunman on your block.

The motivations of people who want to actually get something out of you are quite different. They're not interested in destruction, because that would harm their target. They're usually interested in being undetectable. A social engineer will pretend to be locked out, ask meekly to be let in, and behave like a normal employee until they get what they need and leave normally. Defenses like "don't let people tailgate" work for those people. A gunman will just shoot you, break the door, ignore the alarm, and keep shooting until the cops kill them.

Similarly, someone who's trying to attack your business with a malicious USB drive will give you a USB drive that appears to be a normal one, that maybe pops up a terminal window very briefly and then disappears. You likely won't notice that you made a mistake, and you'll probably see an actual drive pop up on screen. Someone who's trying to attack your business will generally not give you a USB drive that destroys your computer immediately. (For most businesses, computers are not worth much compared to the secrecy of the data they contain, anyway, which is why full-disk encryption is a reasonable defense; it assumes that a computer might be lost and that this is recoverable.)

So a good security training program should say "These are ways where people might try to subtly break in to gain access that you might not have thought of before," not "Sadistic sociopaths exist, wear plate armor at all time."

Actively using it to harm others is different than just creating it.

Creating it and selling it is an obvious attempt to profit from the custom of those who wish to use it to actively harm others. There's literally no other reason for anybody to buy an "anonymous" one over a standard one which says what it does on the stick, and yet they're charging $5 more for the anonymous one...

It's a curiosity item. I would buy an anonymous one if they were $30 or less. It's interesting to have around, a conversation piece. The anonymous one increases the interest, because it better demonstrates the danger, the precariousness.

Yeah, that'd be crazy.

https://reason.com/2019/03/21/indiana-cops-pelted-teachers-w...

https://www.theatlantic.com/health/archive/2018/02/effects-o...

https://www.dailymail.co.uk/news/article-6506443/Police-rele...

Might make sense, yeah. How many computers would get blown up during such a test, and how much productivity would be lost and how much money would it cost? What is the expected cost of a major breach or malware infection? How much less likely does a breach or malware infection become as a result of leaving one of these laying around? I actually wouldn't be surprised if leaving these did come out positive, in much the same way that regular fire drills come out positive.

When you're holding a hammer, everything looks like a nail!

I can't even imagine a situation where police would want to destroy a running device that could likely have evidence stored in volatile memory. Even if it was their own device that they were retiring, it doesn't even wipe data, it just destroys the logic/motherboard.

Hardware designers might want one to test out their mitigation circuit but once your design, why do you need a USBkill anymore?

This thing just seems like a destructive version of those annoyance toys like a TV-B-Gone.

I've never heard of TV-B-Gone.

> During the 2008 Consumer Electronics Show, an individual associated with Gizmodo brought a TV-B-Gone remote control and shut off many display monitors at booths and during demos affecting several companies. These actions caused the individual to be banned for life from future CES events.

https://en.wikipedia.org/wiki/TV-B-Gone

The innocuous use of TV-B-Gone devices was to shut off at once all TV sets at malls; it was rather a prank than a destructive act, with the added benefit of getting some peace.

Was there a TV-come-on to turn on the mall TVs in the morning?

Not that I know of, but technically doable since all it needs is transmitting through infrared the corresponding signal variants according to different brands. By modifying the source one could for example set all TVs to maximum volume, or tune them to channel 666, or even give different commands to different brands as they share the same IR codes.

Mitch open sourced the entirety of tv b gone from the start. It's pretty easy to make this tv-come-on. The tvbg is just a ir driver and:

    foreach offcode in list_of_offcodes:
        transmit(offcode)

You need the TV-B-ON version

Back in the day you could turn a HP-48 into a universal remote control. Oh, the pranks we pulled on an unsuspecting teacher (the teacher was the worst kind ever of know-it-all prick, and duly deserved it).

"I can't even imagine a situation where police would want to destroy a running device that could likely have evidence stored in volatile memory."

Exactly. That device has nothing to do with police or testing. The politically correct name is a way to avoid filters or to claim ignorance in case some customers do nasty thing with them. Not different from cellphone/gps jammers sold under the "signal/field generator" name.

"Even if it was their own device that they were retiring, it doesn't even wipe data, it just destroys the logic/motherboard."

And it's even very bad at it: most computers have internal usb hubs that would act as a (weak but sometimes successful) defense against these devices.

TV-B-Gone has many practical uses, especially in public places where TV is foisted upon the general public

My business partner is a supplier to LEA / Government for intrusion / pentest / physical and electronic security. He has sold over 600 units to legitimate government and police entities.

Likewise, the USBKill suppliers had shown confirmed clients from all large SV companies, and all major hardware manufacturers.

It definitely is a malicious device in the hands of someone malicious, no doubt... But it most definitely serves a purpose to government and LEA apparently ..

I could see this being used to check USB chargers to make sure they don't catch fire when weird things happen

Also activists / journos in some countries. I know we have looked at various emergency destruction techniques over the years.

USB killer would not be an appropriate way to do that, it'd just give a false sense of security.

I wouldn't be so sure. Frying an SSD efficiently is a good use.

But this is USB.

Yes, efficiently frying an SSD can be a goal. No, this device does not do that.

"I wouldn't be so sure." is not the right test to pick. Yes it might destroy the SSD, but more likely just burns out something on the motherboard.

When you are picking an emergency destruction method your test should be: "I'm reasonably certain that this irreparably destroys the data"

True. But options are limited. Something is better than nothing in a scenario where secret police are at your door.

I mean, it's not like it's expensive to manufacture! One person soldering and maybe a single board and usb plug, its probably easy to make money if you can sell them for $30 or so in the volumes of 100's.

> Is the device safe? > The USB Kill and the USB Kill Testing Shield are safe to use. Both devices have been manufactured, tested and certified as CE Approved. Test in complete confidence.

This device that is designed to destroy computers is perfectly safe to use ... I don't know what to say to that.

Safe for the user, not to the computer I assume.

I kinda doubt that. If you unplug it while in use and stick a key into the USB plug, you might get a painful surprise...

I could see it being useful for when you want an easy way to get a high voltage spike out of a 5v power supply. For example, if you wanted to build a board for igniting the gas in a potato gun that ran off of a USB power bank.

Speaking of power banks, what would happen if you plugged this device directly to one?

Only one way to find out!

most power banks don't have the data lines, and as far as I see this device uses the data lines to destroy the host. So I'll guess nothing would happen.

You could design one which did destruction via the power lines if you wanted to.

That's much harder though because power lines tend to have big-ish capacitors on them.

Then you want something like one of these instead:

https://www.ebay.com/itm/DC-3V-5V-Arc-Generator-High-Voltage...

You also want to use the gas dispenser from a Paslode impact gun, an air mattress inflator and a Zodiac check valve for the air purge.

"-200VDC is discharged over the data lines of the host device. This charge/discharge cycle is repeated many times per second, until the USB Killer is removed"

Is there any device that is supposed to survive this?

In other news, throwing your computer in a fire also reveals a serious vulnerability.

You'd need opto-isolated data lines. I can't see any common devices having that.

Newer Apple devices should be protected.

Why?

For a time, macbooks had opto-isolated USB ports[0]. I think they don’t anymore though.

[0] https://github.com/usbkill/community/wiki/Consumer-Laptop-Ha...

Call me highly skeptical. Every reference I've seen to this claim seems to point back to usbkill.com making it itself.

The problem is: optoisolators are very slow. Building one which goes faster than 12Mbps would be nontrivial; I do not think such a thing existed in 2014 (which usbkill is claiming). This implies that Apple has alien technology.

I think it's something else.

  The problem is: optoisolators are very slow.

Many are but they don't have to be - an optoisolator is just a zero-length fiber optic cable. Ain't much higher bandwidth than a fiber optic cable.

Not saying apple laptops ever had optoisolated USB though.

IMHO the problem with isolating USB is the 480Mbit ("USB 2.0") bidirectional signal.

12Mbps/1.5Mbps is easy. ADI has an integrated magnetic isolator chip. For hobbyist use you can get this assembled on a board ready to use as an ebay special.

The 5Gbit of USB3 is two unidirectional links and so is also easy (monoprice and elsewhere sell optical USB3 cables).

And lest you think you'll isolate at 5Gbit and then use a hub to translate to 480, USB3 doesn't work that way - the backwards compatibility is provided by a complete USB 2 bus in parallel.

For general isolating (say an electronics workbench), it's easiest to consider the USB host floating (eg a dedicated bench computer), and rely on ethernet (T or SX) for the isolation.

Beyond that the host has to supply 5V to the USB device, couldn't you just cause some damage by sending 200V on these lines? You might only fry the USB power supply but that's enough to be a major pain.

Would that even meet the USB spec? You could isolate the entire USB module, but I don't think you can just isolate the data lines.

And you'd still have to deal with the big spikes coming in on the USB power pins.

For a while, macbooks were built this way: https://github.com/usbkill/community/wiki/Consumer-Laptop-Ha...

But the recent/2018 ones are vulnerable? Why? Cost cutting?

Probably related to the switch to USB-C, which started with the 2016 models.

Ethernet will probably do fine. The differential pair ends in a transformer, so unless you pump so much current in that it physically melts the transformer or wire, you'll be fine. USB should be similar, but apparently is not. (In the case of the USB killer, the amount of time where 200V is applied to the circuit is probably very tiny. I imagine it's just a charge pump that charges a tiny capacitor and discharges it.)

Ethernet is designed this way because the differential pair can apparently pick up a bit of a DC bias when laid next to cables in the ceiling/wall. While researching this post, I found that the spec requires the transformer/inductor to work correctly with a 30mA bias current. I am too lazy to go measure what the DC resistance is, though, so I don't know whether or not 200V is close to that.

When I was in high school, I wired up a cat 5 cable such that each pair was connected to one phase of the mains. I then plugged it directly into my iMac. There was no damage to the computer and the Ethernet port worked fine afterwards as well. (The integrated monitor went crazy; this was in the CRT days and presumably the Ethernet transceiver's magnetics make a good degaussing coil).

The transformer mainly protects you from a voltage difference between a twisted pair and ground. Much less so from voltage across a twisted pair. But saturation could help limit the current spike, at least.

That makes sense. The pair shouldn't have a voltage on it, that's why it's a twisted pair.

Oh dear god, why did you connect your iMac’s Ethernet port to mains? Did you expect it to survive?!

The fact that Ethernet functions the same with a voltage bias across the leads is exploited for PoE — power over Ethernet.

> Oh dear god, why did you connect your iMac’s Ethernet port to mains?

Because I was 15 and bored.

Wouldn't you be more bored if you found yourself without an iMac?

In college I stripped one end of an Ethernet cord and plugged it into household current. The other end I had hooked up to an old laptop I no longer wanted. The wire exploded, and the motherboard was fried. YMMV. Laptop was an old Sony Vaio c. 2001 vintage if it makes a difference.

(On the plus side, this made up for sleeping through that physics class where my professor did the exploding wires demo.)

Household current is AC, the transformer will pass it through.

I vaguely recall the argument (maybe buried in the USBKill site) that manufacturers could ~easily limit maximum voltage across the data lines. Maybe using a resettable fuse? I know that Raspberry Pi limit USB input voltage to ~5V, for example.

Raspberry Pi limits the input voltage with a Zener diode across the input. In a Zener used this way, the current flow through the diode varies with the voltage difference between the input and the output - so with enough voltage input you can still make it fail, as you can exceed the max power dissipation of the diode and then it will burn - and after that, your circuit is not protected anymore.

OK, so is there any other purely electronic protection method? Or are optoisolators the only option?

I can confirm that you can indeed destroy an RPI0 by accidentally connecting a power supply to the USB port while another power supply is connected to the power supply port.

> Is there any device that is supposed to survive this?

There used to be...

As a boy - and this is many, many years ago - I once, ehm, accidentally connected the external speaker-plug on an old vacuum tube household radio to the 220V mains.

A very loud bang, and the house went dark. The radio, however, was fine, although with an interesting new tonal slant to everything.

As a young man, I grabbed a 6146B tube before it discharged. I felt fine, until the pain started.

Because radios in those days were made properly, without planned obsolescence!

That's the filter of history at work. By and large, old radios were not built to last. The only ones that survive are the ones that, because of good design, good luck, or gentle use, managed to make it to today.

I repair & build vacuum tube equipment as a hobby.

>The manufacturer calls it an "ESD tester" yet there is an "anonymous" version available

plausible deniability. selling devices specifically for committing crimes is illegal. that's why all the bong shops say it's "for tobacco use only".

> that's why all the bong shops say it's "for tobacco use only"

Unless you're in a state that's legalized it.

If you use that word again, we'll have to ask you to leave. They're water pipes.

I like to consume my tobacco via a steamroller or gravity water pipe. So refreshing.

Totally off-topic question to this thread, but what's the reason for being kicked out of those stores for saying "bong"? I would have guessed that as long as employees don't use the term, it's fine for the company for the customers to suggest what they'll actually be using it for.

Going to throw out a guess and say it's because selling you an item after you called it a bong is admitting that it's indeed a bong.

Ah, that makes sense, question answered.

My second question is that if bongs and water pipes are the same thing, why does the law distinguish their purpose by their name? It seems like given "I want to buy a water pipe for smoking the marijuana" and "I want a bong to smoke tobacco", the second should be legal to request, not both.

I'm pretty sure it's CYA more than anything. The DEA is very aggressive and raids like it's going out of style

_bong_ is considered drug slang, water pipe is not.

intent determines if a thing is illegal. If you intend to use that bong for weed it’s pariphinalia and a felony, if you intend to use it for sheesha it’s fine.

if you intend to use that power tool or crowbar to break into a house it’s “possession of burgular tools” and a felony, if you’re a contractor there to install some drywall it’s not.

Because you might be a police agent trying to make them admit that they are knowingly selling something illegal.

Can we get something a bit more technical to give it a more refined and scholarly name? Perhaps Hydrostatic glassware.

Head shop I used to go to in the mid-90s kept their "water pipes" in a locked back room. You couldn't even buy one unless they'd deemed you "hip to it, man" or whatever.

Mine sold wicker furniture in the front, but the back was water pipe city.

> plausible deniability.

Why would that be necessary?

Jackhammers are tools to destroy pavement. But nobody sells jackhammers as "ground strength testing tools".

These are tools to destroy computers. Both are completely legal as long as you are not destroying someone else's property without permission.

That highly depends on the jurisdiction you're operating in / selling to.

While I'm not aware if anybody has ever been convicted for weirdly defined laws like that we for example have a "hacking paragraph" in Germany that outlaws software for the sole purpose of computer crimes. I'd imagine the UK has similar legal areas in lieu of their recent "kitchen knives are dangerous weapons, sometimes" controversy. It's not that hard to imagine somebody going after the manufacturer of such hardware and that blurb (or the ever famous "for educational purposes only") give them something to reasonably distance themselves from a user's actions.

It's easy to come up with a legitimate use case for destroying pavement, not so much for USB ports. Testing the ESD resistance of computer equipment on the other hand might be a legit use case.

Secure destruction of equipment you're discarding is a valid use case. Depends on how much of the board actually gets fried.

Everyone recognizes that jackhammers are necessary for the built environment that supports our civilization. The understanding that “hacking tools” and the like are necessary for our online civilization is less common.

It may be designed for a cut and run approach. For example, about to crash in enemy territory, brick all the computers.

Only when supposed to do it stealthily. Otherwise there are faster military options, to destroy computers.

In that case, you want to do a lot more than brick it; you want to destroy disks, ROM, and in many cases even PCB boards.

Explosives will destroy, but recognizable parts will survive. Your safest bet probably is burning your computer, fast and thoroughly.

I think white phosphorous is a popular choice for this kind of thing because it’s relatively easy and safe to transport, store, and deploy (compared to, say, strong acids such as aqua regia)

What about thermite? Melt right through the steel platters of a hard disk!

Thermite is surprisingly bad at killing disks beyond recoverability.

Search for "and that's how I lost my other eye" from defcon23. Probably available on YouTube.

From that page:

>Does not require batteries, can be be used an unlimited number of times.

So how does it work? How can it recharge all those capacitors?

I believe they charge from the port first then discharge back into the port they just charged from.

It's not an ESD or a surge tester; the manufacturer doesn't even pay much attention to differentiate between the two. Surge testing is done with well-defined waveforms like 8/20us pulses of specific voltage; ESD testing is done by discharging a specific voltage from well-defined source like 150pF/330R. This one is simply advertised as "powerful", meaning it doesn't respect those specs.

To elaborate: surge/ESD protection components work on the basis of thermally dissipating incoming energy that exceeds voltage threshold. They're specifically designed to clamp single, short, high-energy pulses - not repeated pulses or constant voltage. A TVS or MOV will overheat & explode if you subject it to DC higher than its breakdown voltage, or if you subject it to repetitive load - they're simply not designed & rated for that because it's not what happens in the real world. You just don't get repetitive lightning strikes or repetitive ESD discharges in real life, and they don't protect against that.

TL;DR: With enough voltage & current you can fry anything and that's what the device does.

Maybe could be handy to distroy terminator robots and inactivate war weapons in the future. Who knows?

One thing is certain, they will have a USB port.

College of St Rose lists their tuition as $29,826/yr. So he did about 2 tuition years of damage.

I wonder if he was worked up about student loan debt.

I'm guessing he's a rich kid from India, with rich parents who are bankrolling his education.

I hope he gets the full 10 years. Nothing like the US Penitentiary System to teach you a lesson.

It's just a piece of plastic. Very intricate, relatively expensive silly plastic.

You are demanding blood and to trade off a huge chunk of human life for the silly piece of machinery (which he gonna pay fore anyway), are you feeling well, my friend?

It’s not about the computers. This individual has demonstrated he has no regard or respect for others property, and may very well go on to commit other more serious crimes if he gets away easily with this one. Others may also feel encouraged to imitate what he did if there are no serious repercussions.

The great thing is, he also flushed his future down the drain, at least outside of India (every visa application in the world asks you about past criminal convictions).

Or to use a more apt metaphor, he zapped his future into smoke.

The reason I think this is going to result in jail time, is this is not just one or two isolated incidents.

But instead the 59 incidents make this a willful act of vandalism.

It doesn't get more "wilful" than filming yourself doing it, with glee.

> I'm guessing he's a rich kid from India, with rich parents who are bankrolling his education.

What is this guess based on?

In my experience, most are relatively rich compared to other people in their country. I am under the impression they have to pay full price (which the schools love) and they pay cash since loans are not available.

I grew up in India and had friends who were rich and entitled? A guy I knew one day decided to kick in the car doors of a dozen cars because he was pissed (I think because he didn't get to park there...?). Anyways, cops were called, but parents wrote out hefty checks and that was it. I have seen this kind of behavior before.

> I hope he gets the full 10 years.

Ten years for vandalism? That's injustice.

You don't even know why he did it. Perhaps he was just an idiot, perhaps he had a legitimate grievance that he didn't know how to "rectify" otherwise.

> Nothing like the US Penitentiary System to teach you a lesson.

Oh really? Then why does the US system have one of the highest rates of recidivism in the world? Why does the US have the highest incarceration rate in the world, perhaps with the exception of North Korea?

> Perhaps he was just an idiot,

Considering he filmed it, this is the most likely explanation anyway; you should ruin someone life over that? Make him pay 200k in fines and that’s it; jail time is insane for this imho.

Exactly. Nobody got hurt, so a fine is enough. To stop him from doing this again, there could be a harsher punishment for repeated offence.

Problem is, the fine will be paid by his parental units, which doesn't teach him a lesson at all; in fact, it reinforces the lesson that he can do anything he wants, and parents will take care of it.

If he's over 18, his parents wouldn't be liable.

Would you pay a 200k fine for your child?

I'm curious how the damage breaks down, because it sounds like a lot of that damage might have been him destroying just a motherboard and then the entire computer being written off.

Corporate/university IT shops don't normally do component-level replacement. Both due to time constraints and the nature of their support contacts.

(Assuming the Dell/HP/etc. workstations they bought even take standard size motherboards. I've seen some that don't.)

Our Helpdesk does full on replacement work. I have seen them swap out mobos even CPUs. We are our own service contractor with Dell, HP, and Apple.

Wow. I want to work at that helpdesk. Every helpdesk I've encountered is just an intermediary for outside service.

Well, with the cost of finding a specialist amortized over 59 computers, surely it becomes worth it at that point.

Corporations and big organizations don't think like regular people. Yes you can repair the computers saving money, but now there would be no support from the OEM, and they would have at least two different systems - the repaired ones and the working ones, because I don't think that motherboards for custom office PCs they have (like HP or DELL PCs) are off the shelf. I have an old compaq PC I upcycled as a home server, everything inside is built to fit together and be very reliable, it is nowhere close a typical PC build. The motherboard isn't even square.

Don't OEMs offer paid repairs themselves?

The USB killer isn't really needed if your going to do it yourself and leave evidence. The use case would be to give it to someone else, or do it once in a reasonable manner and claim ignorance.

*You're

Why can vandalism result in a prison term? I'd expect paying damages is a sufficient punishment for stupidity. Genuinely curious why the consequences are structured this way.

Deterrence. To some, the damages are pocket change.

When we (Dutch) ask in school why our sentences are so low, it is explained that if the punishment does not fit the crime, you will be incentivized to add more crime because you are already facing prison time, so why would you care about a few years more or less. Aka if the crime for rape is almost the same as murder you might as well kill the victim to have less chance of being caught. We have not a lot of crime and people who commit crimes like this come out of it as long term productive citizens: if you go to jail, what exactly are you doing/deterring? He will never have a normal life because of some stupid thing he did? Do like (i think) scandinavia and swiss; make fines fit the economical status of the perpetrator.

Edit; me and my friends did dumb things when young, not quite this dumb, but enough, if tried as adult, for prison time in the US possibly and caning+prison in for instance Singapore ; what exactly would that have done? We are all highly successful tax payers and it was foolishness that occured once or twice, 30 years ago.

here's an example that disputes your assumption: Japan has much less criminality than NL, and has one of the harshest prison systems in the world. you can leave your expensive bicycle unlocked on a crowded tokyo street and no-one's going to touch it. you can leave your expensive apartment completely unsecured and no-one's going to get it. they even still have the baggage lockers all across their subway. a lot of this is due to how scared people are of their police/imprisonment, and the subsequent social downgrade.

> Japan has much less criminality than NL

Seems that depends on where you look but it's at least on par or below, so point taken.

In Singapore it seems to work well as well. But I always assumed because it is so tiny they will always get you and you will get punished.

It is interesting to learn more and it is a difficult issue which probably is partly unsolvable, I show one perspective, but that might not work elsewhere. I just do not see the damaging a young person from taking part in society forever is a good plan, at all, for small infractions without bodily harm.

> and the subsequent social downgrade.

By no means I claim to know much about Japan but from what I know from reading/watching a lot about it I would wager it's more this than the punishment... But it would need research I guess to figure out why the differences.

I'm not sure Japan is a good comparison, it is so different culturally that you can't read much into the differences.

Can you elaborate more about how the culture would compensate for lower crime?

Apart from being one of the most ethnically and culturally homogeneous countries in the developed world, Japan is the only country in the world to have suffered a nuclear attack (twice!). This fact makes Japan an essentially unique society, not entirely comparable to others. The mindset of Japanese people today is completely different from that of the Japanese for centuries prior to the Second World War.

Actually there is theft, for example, I watched a TV program about shoplifting and they caught several people, like a company of school girls or an old woman.

The bicyles must be registered in Tokyo if I remember correctly.

Also, they have unmanned selling stalls, usually in the countryside, where farmers sell fruits and vegetables [1]

[1] http://abritishprofinjapan.blogspot.com/2017/07/unmanned-veg...

There's an interesting reason for old people getting caught shoplifting in Japan. One of the many articles covering that:

https://www.bbc.com/news/world-asia-47197417

Perverse incentives at work. If the jail cells in Japan were anything like Rikers, this wouldn't be a thing. Conversely, societal institutions for the elderly could also work.

Even England has unmanned selling stalls.

Just a box of fruit/eggs/unwanted gifts and a box for cash and a sign saying '£1 per item'. At the end of the day the owner takes the cash.

Only happens in the country though, and even there sometimes people take goods while 'forgetting' to pay.

I see the point, but the amounts described in the article are going to deter 99% of society already, so I find focusing on the 1% implausible. Is there anything I can read about such deterrence?

Question is; does it deter well? What are the crime stats on vandalism/destroying propery crimes in the US vs other countries. If it is like other crimes, the over the top punishments do not seem to deter vs the lightweight punishments in some other countries.

I’ll add that deterrence breaks down into two different prongs: (1) deterring this particular guy from doing the same thing again and (2) deterring others from copying what this guy did. It might seem unfair to punish this guy harshly when a lesser punishment would deter him from ever trying the same thing again, but that is ignoring prong (2), the value of punishing him as a warning to others.

The deterrence is probably mostly for the group in (2) but because that group already knows what the punishment is because of the deterrence in said region, but find themselves (by whatever peer pressure, stupidity, drugs&alcohol) find themselves in this position, they may find the deterrent a guideline to add on more crimes because it does not matter. In this case, if he knew about the punishment, he probably would have fled the country the next day. Making a crime go unpunished; if he just is flagged and cannot leave the country and has to pay 100k in fines, he might be a good citizen and pay taxes in the US the rest of his life. I cannot see these harsh punishments work well (and seems they do not as people keep doing crime more than elsewhere) but it is probably needed to get elected (soft on crime!!!).

> if he just is flagged and cannot leave the country and has to pay 100k in fines, he might be a good citizen and pay taxes in the US the rest of his life

Yes, he might; or he might go through life wantonly destroying other people's property whenever he feels he has a grievance, as there don't seem to be any serious consequences for doing so.

It's a hard question, and individuals vary so much (circumstances, motivations, character, ...) that generalised answers will often be wrong. But a justice system needs rules and standards of some kind.

> But a justice system needs rules and standards of some kind.

Sure, but having to get a job (he has an MBA so he was planning to) and having the tax office take 70% of his wages until paid off (or allow him to pay off faster if he can) is not a light punishment while it does bring back some productivity. Jail time or over the top crazy punishments doesn't seem to help either and only costs society money. And then more money because the individual will most likely never recover after having spent some of his most productive years behind bars.

The sore point here is ofcourse that he is on a student Visa in which case I think the punishment of giving him a criminal record and sending him back to India is harsh punishment in itself.

Most foreigners who can afford to come to the US for a post graduate education come from a relatively comfortable situation at home.

The problem with this is that law is not written exclusively for foreign postgrads.

That is not really a problem because there is usually a lot of flexibility given to the judge in sentencing. The judge can determine an appropriate sentence within the maximums (and sometimes minimums) set by the law.

FTFY: Revenge.

Prison certainly didn't seem to deter this guy, nor does the death penalty deter murderers.

http://www.deathpenaltyinfo.org/files/DeterrenceStudy2009.pd...

The damages are simply too small.

If the damages included the cost of the investigation, the impact of being without computers for months, etc. then the school wouldn't mind the incident happening again and again.

Is prison going to make this person better?

"According to the Vera Institute of Justice, incarceration costs an average of more than $31,000 per inmate, per year"

  damages: 60k
  fine: 250k
  price to incarcerate him for 10 years : 310K
  ...
  ... profit?

Long ago, I worked for my uni's departmental IT group.

We made our own etherkiller, hung it on the wall with a sign "USE IN CASE OF SUN".

Never used it in anger, but it was fun to dream about...

In one class we we're building a custom circuit to talk to a custom 8-bit computer over the ISA bus. I accidentally put one chip upside down (it was some off brand and I mistook a scuff on one end for the marker for which way is up) and killed the DOS PC :P

The custom 8-bit computer was fine though.

Classic was inserting an old 16k DRAM backwards.

Hmm... something smells hot... touch touch touch sound of screaming

Or inverting the two halves of the AT power connector

Always a bit terrifying powering up the MB for the first time.

> USE IN CASE OF SUN

What does it mean?

Sun Microsystems maybe?

Could imply that should it be sunny outside, the etherkiller allows creating an outage which leads to taking the day off?

We had made an ill-considered deal with Sun Microsystems for a bunch of workstations maybe 18 months before they went away for good.

The machines were badly laid out, poorly specced, and prone to annoying failures.

They deserved, but did not receive, mains power right to the ethernet port.

Any word on motive?

February-ish is normally acceptance letter time, but it doesn't make sense. He'd already graduated, and nobody get an MBA and then applies for further graduate study.

Maybe he got a MBA, failed to get a job, then tried to reenroll, and got denied?

It was on Valentine's day. I wonder if that has anything to do with it.

Maybe for the lulz/attention? The pdf says that he recorded himself doing it with his phone.

How do you obtain a MBA while being so stupid?

Knowledge and stupidity are multidimensional and orthogonal.

You need to meet more MBA graduates. The stupidity ratio will astound you.

What do you think the qualifications for an MBA are?

Ability to pay the tuition fees.

When did HN become so cynical?

After we paid tuition fees.

Wannabe criminals are getting dumber day by day. Is a fact.

Fifty years ago the idea of doing something ilegal whereas filming yourself smiling to your own camera, would tag you as martian. Currently all is like: look at me; I'm badass!! I'm a malote!! I want to rub shoulders with the bad guys!!. Hem... Nope, you are an idiot.

there used to be a thing called usb condom https://duckduckgo.com/?q=usb+condom&atb=v119-3__&ia=web

to cut data lines altogether IIRC

I guess we need a new kind of condom with all lines protected for surges

ps: there are also these https://www.alibaba.com/countrysearch/CN/usb+isolation+modul...

> According to court documents obtained by ZDNet, and the suspect, Vishwanath Akuthota, 27, filmed himself while destroying some of the computers.

Never understood why people film their own crimes?

To show their shitbird criminal buddies and giggle over?

"He faces up to ten years in prison, a fine of up to $250,000"

That is crazy. He is obviously not completely 100% in the head and needs psychological help not imprisonment.

Isn't such decision supposed to be a court ruling? I don't think that persecution can suggest psychological help in US court system.

I think you meant to say prosecution. But persecution sounds fitting here because exactly the problem you state: mental health needs more awareness and application for people who suffer from these problems. Putting them in jail is the worst thing for everyone.

Can someone tell me what would happen if you plug this onto a USB charger via an adaptor that is plugged to 220V AC?

Quite possibly nothing. A USB charger following the USB Battery Charging Specification has a resistor < 200Ω across D+ and D-. Just putting -200 V on D- and doing nothing to D+, there's not a completed circuit. If the charger uses the data lines for anything (e.g. Apple devices), perhaps it'd burn out whatever microcontroller is running things in the charger.

The school did a Q&A with him on FB, apparently long before the incident: https://facebook.com/saintrosegrad/posts/10154835183318203

> how long before it disappears

a while: http://web.archive.org/web/20190419041118/https://m.facebook...

What is a "computer-enhanced podium"? Why would I ever plug a usb stick into a podium?

Because it has an USB socket.

We have some. They are podium's that have built-in computers or some just have touch monitors and you supply the computer. They all have USB extensions so you don't have to dick around behind the thing to plug USB in.

Likely just a podium with a dedicated laptop already connected to and optimized for the A/V system. Allows you to put a powerpoint on a USB and stick it into the machine and present from that, rather than messing with dongles and cords and A/V compatibility.

Most decent (read: non-american) long haul airlines and even some 737 have USB sockets at each seat for charging devices, what effect would this have in the air?

good question! I have wondered about this when plugging my phone in and being asked “do you trust this computer?”

All Inflight Entertainment Systems are completely isolated. You'll fry your own screen, enjoy the rest of your flight.

Woudln't that be a fire harzard?

Maybe "fry" was the wrong word to use here. The USB device mentioned in the article doesn't work after it kills the device so the components actually don't get too hot after the initial surge.

Also any battery on your device is also a potential fire hazard. There are procedures in place to deal with such cases.

Some people are issued devices like these by their employers…

Maybe the student thought that it was a normal flash drive and tried to find a working computer that can open it?

Also, isn't ten years too much for just destroying a property? It's not like anyone got hurt.

>Also, isn't ten years too much for just destroying a property? It's not like anyone got hurt.

The (unspoken) point is to send a message of deterrence. Be a thorn in the side of important institutions and they will screw you hard.

From the article:

> "I'm going to kill this guy," "it's dead," and "it's gone. Boom," Akuthota said on recordings obtained by the prosecution.

Where did he think that was a good idea?

Almost enough.

The device was bought on a website that advertises it as an "ESD tester". Couldn't the student blame this on false advertising?

And then he tested it on 59 different computers, just to make sure it works?

Someone brought this up in an older thread about this device.. Why use this? You could just use a hammer, or pour water into them. It seems bizarre that he paid money for this device when there are many completely free ways to trash a pc.

I assume someone would notice if he started smashing up computers with a hammer. No way he'd be able to destroy as many.

I imagine it’s much easier psychologically for a vandal to do this than anything obvious with a hammer or water. Also, you would think he’d probably get caught after the first or second monitor if he walked into a library and started smashing shit.

Yeah good points, I guess it is fairly discreet + also its novel so most people may not cog what hes doing very quickly. Is there not a pretty intense burning smell from the fried components though? .. So, its extremely situational. Use when you want to trash some running pc's in an occupied public area and not have people notice immediately maybe.

I completely understand the desire to do this. Universities do things that make you want to obliterate them with a meteor. What I don't understand is recording yourself committing a crime.

Reply on news.ycombinator.com