Hacker News Reader

Comment by marginalia_nu | Hacker News Reader

Strange flashdrives are also a bit sketchy.

I know there were diskette-viruses, but you can straight up fry a computer with a flash drive that has been tampered with. USB in general doesn't really seem to be designed with security in mind.

View on HN

You can either have a port where you can run trusted devices without hassle, or one where you can input untrusted data safely. You can't have the same port do both.

That's an inherent problem with universal ports that do a bit of everything as opposed to having distinct storage-oriented media. I don't know how you'd tamper with a diskette to brick a computer.

Ah, memories...

https://stickdeathgod.tripod.com/id23.html

> you can straight up fry a computer with a flash drive that has been tampered with. USB in general doesn't really seem to be designed with security in mind.

I don't think it's fair to claim USB is insecure because you can buy accessories that charge a capacitor bank over the 5V, and then feed that back to the computer.

That could be solved by using an isolated hub to host USB devices, like the Spectra 3022. Then again, if you have equipment that expensive, I hope you're not plugging random stuff into it...

I wonder if there's a market for USB hubs with breakers/fuses to protect against this. Probably only security researchers plugging in known-sketchy things though.

The thing is, adding an inline fuse doesn't guarantee that the host would be safe: if the fuse doesn't blow quick enough and lets enough current through, that's bad (plus, you'd have to add a fuse to P-, D+, D- and P+ just to be sure, not to mention USB3). The best option would probably be a complete isolation of the USB device from the host, with a hub that then transfers D- and D+ to the host without a direct electrical connection (while providing its own P- and P+). Think TOSlink, but for USB.

Galvanic USB isolators are a thing. Mostly for medical applications, but it's literally a chip you can buy off the shelf that provides total electrical isolation (with the addition of an isolated 5v supply).

There are digital isolator ICs, like ADUM3166 from Analog Devices, though like none of them are for USB 3.0+ Awful lot of isolation transformers in the IC diagram, so I'm sure that something like the transformers used for Ethernet could be reused to protect basically any USB ports from a USB killer attack, though they are awfully big for a smartphone

The industrial hubs I'm familar with use optoisolators to separate the host and attached devices, I think. Advantech has a USB-3 version (P/N USB-4630), but I can't speak to these personally.

Absolutley. In a hardware-development context, we use them to stop frying computers with broken devices. I've had good experience with the BB-UHR304 from Advantech. They're expensive and occasionally sacrificial, but cheaper than replacing an average pc / laptop. https://www.advantech.com/en/products/c9300564-0829-46eb-955...

Reply on news.ycombinator.com