USB Killer

Having worked at companies who actually have a high level concern over computer security, telling someone simply isn't enough. Being told is passive. Passive defence and active defence are two entirely different states of mind. Defending against an attack needs to be active and instinctual. Every time you open, close, or set down your laptop, a small part of your brain should be thinking about it. In computer security, a single failure is enough to lose control, so it's useful to have an environment that reflects that.

A simple example is being told to keep your terminal locked. This is a common rule for most workplaces but is usually met with dismal failure. One of the companies I worked at actually made a game out of leaving your terminal unlocked. I can tell you, after a few days of your colleagues kindly laughing at you returning to a screen full of Internet memes, you instinctively Ctrl + L upon standing up, even if it's to walk to the windows to look at the view.

Why is it important I lock the screen even if standing a metre away? My friend walks by whilst I'm staring at the view and invites me to [coffee|walk|game|X]. Security has already left your mind and you head off to do [X], leaving your terminal unlocked. Even worse, your screen might auto-lock in a few minutes, giving you a false sense of security when you return. Even if it was unlocked when you returned, you'd likely get back to work, not realizing your error.

Making security a game is a good way of instilling the practice. Colleagues make for cunning adversaries and make you actively defend yourself. This defence is useful against both pretend threats and real ones. Wargames are wargames for a reason.

If they can install they will and it will continue until someone starts firing people over it.

If they cannot install, prepare to get scolded when they cannot install fileshare clients, flash games, "codecs", -you name it: they'll install it if there is even the slightest chance it will let them watch something they wouldn't be able to watch without.

I sometimes have an image inside my head what it would be like if chefs would be like office workers in this regard: sharing their knives with friends and family, drag their knives into the garden, use them to poke in the sink, stir the paint etc.

IMO that's an overkill. Why not just use ICloak [1] or Tails [2]? They are both Linux distributions which boot from USB stick without touching hard drive, randomize MAC address and give you access to Tor and other goodies.

[1]: https://icloak.org/

[2]: https://tails.boum.org/

First the total power of the USB port is ~2,5W on average and given the constraints of the device in terms of size (~ a normal USB thumb drive) you cannot realistically store this more than a second or so (e.g. 100V in 1000µF is only 10 Ws).

With 2.5W you can make things hot to touch, but for igniting anything flamable, you'd have to design some thermally decoupled element to dissipate the power, and get glowing hot (e.g. a small coil of resistance wire in a car's cigarette lighter). Unfortunately devices on a PCB are normally very well thermally coupled to said PCB, so the energy spreads fast limiting the temperature of the individual components. Also things on a PCB tend to break at much lower temperatures than what you'd need to ignite anything. Also they will already desolder themselves at ~200 degC.

On that note, using it as a pentesting device could be interesting. Perhaps just use the "beep" so the auditor can see how many people trust putting anything into their PC, then at the end cite USB killer.

I really wanted to go much higher with the voltages, but the amount of noise this thing puts out de-focuses the camera.

When the place was raided by the police and the computer confiscated, the fun and games began.

The computer was never returned.

Things like not being able to stick things into the line/neutral holes unless the ground pin (which is longer) is inserted make them very safe, and the plastic lower part of the line/neutral pins to stop you accidentally touching something that will have current running through it until the plug is safely inserted is inspired.

I do not now if modern UK homes are still wired like this.

In modern times the individual fuse still makes it safer, but it is also one of the reasons UK plugs are so large and clunky.

http://smile.amazon.com/GE-3-Wire-Receptacle-Tester-50542/dp...

(that's US wiring but surely there's a UK equivalent)

Usual story: replacement part is about £0.50 and I could replace it in the lab, but postage for one part is £4.

Might see if I can get one as a sample, or from the Far East with 'free shipping'.

Many moons ago, I worked in the education sector and some smart kid ran a paper stapler up a keyboard lead, leaving it full of metal staples. The power short blew an axial fuse on the motherboard. The next user encountered a 'dead keyboard', so they swapped it for the one on the next desk..repeat 6 times before someone realised the fault was travelling with the keyboard...

When they ask you to hand over all personal electronics, point to it and say "that's dangerous".

If, subsequently, they want to know why you were carrying it ... it was so you could fry the USB port of your own laptop if you thought someone had snuck some hardware-level malware into it.

If you tell them NOT TO DO IT and they go ahead and do it, I find it hard to see how a court could convict you of wilfully damaging their forensic equipment.

(To the extent there's any social engineering involved, it simply relies on the tendency of police to ignore or discount unsolicited information from members of the public who are under suspicion.)

Note that they won't be sticking the device in a laptop or desktop PC; specialist forensic imaging machines are used by law enforcement to duplicate data storage devices and maintain a legal chain of evidence. Oops.

So, there's nothing about USB that makes people especially deserving of punishment if they go using strange ones; there's a base level of societal trust required for the abstraction of a "side-effect-free data storage object" to exist in the first place.

To say otherwise is similar to purposefully driving the wrong way down the road and getting into a 28-car pile-up, and then saying that this is a lesson in how cars are inherently dangerous and people should avoid driving near strangers. The security mindset can only make you so safe; at some point, you have to trust that strangers aren't trying to kill you in order to be able to live your life.

(Though, in this case, you could just avoid all physical peripherals and ask the person to email you the file instead. At least all you can get from that is a virus.)

https://commons.wikimedia.org/wiki/File:USB_signal_example.s...

In this case the bad device you control is a truly malicious payload whose damage can be measured in dollars.

Besides, pretty much anything can be characterised as "a way" to increase security awareness, up to and including murder of the victim. The victim's friends and family will be a lot more wary of whatever did the murder - the goal of 'security awareness' has been increased. But "a way" is not the same as "a good way".

Say you replace the contents of one of those bright-coloured sticky sweet liquors with a similarly-coloured cleaning fluid? Then leave it in your liquor cabinet, "to teach people to not touch your stuff". I'm not even sure that's legal.

I once heard a story of someone storing their concentrated GHB (a drug, clear liquid), in a vodka bottle. If someone had accidentally poured themselves a shot of that, the consequences would have been pretty bad.

On a similar note, I'm not sure about the US, but in the Netherlands, it's actually illegal to booby-trap your own home. If an intruder gets hurt, you're liable. I don't think this law exists to protect burglars, but instead it is to protect well-intentioned unlucky people from "accidents" caused by terrible and idiotic "security" measures.

Makes me think about the car-alarm in Snow Crash, which delivered a fatal several thousand volts to whoever tried to open it without a key (or maybe it was a flame-thrower, I forgot).

Highly unlikely that 129 people in a row respond like that though...

More likely is that someone destroys the USB device in anger, dismantles it, is too shocked to do anything, doesn't interpret the number as a counter, or doesn't want to ruin other people's computer. And, of course, that many people in a row stealing a USB device from a backpack is already unlikely in itself.