Schneier on Security

Clive Robinson • September 12, 2016 5:15 PM

Hmm must be a slow news day, this USB-Killer has been around for a while now.

Clive Robinson • September 13, 2016 12:26 AM

@ K15,

In a free market, with vulnerabilities like this, the company that outcompetes the others will be the one not subjected to these attacks.

I think you might have that backward.

The “knowing” use of such a device on anothers property is an act of “criminal damage”. Arguably the people who designed, built and “put on the market” such a device are running a criminal enterprise as these are not “multi-use” devices like ordinary tools such as knives or hammers. Further they are not specialised tools like insulation or Hi-Pot testers because they are neither calibrated or instrumentated. Worse they are in effect disguised to look like something they are not and are thus much like any other “booby trap” device. Thus I suspect any person of lawful authority would have little difficulty persuading a court that an individual carrying such a device was “going equiped to commit a crime”.

Thus whilst they might not be specifically legislated against, they would be illegal devices in many jurisdictions. Which brings about the questions of product liability, fitness for purpose etc about the merchantability of any system that this illegal device might be plugged into. Does the system manufacturer have to design it so that it is proof against “criminal acts”, the answer is probably no.

Which brings us around to a “free market” without regulation. In theory such a market responds to a customers wants only. So if a customer does not want a system proof to this illegal device then it will not sell, thus it will not be made. For a customer to want a system proof to such an illegal device, they would not only have to know of the devices existance but also that the risk it presents can not be mittigated in less costly ways.

If the illegal device is hardly ever used in the general market, then insurance is likely to be the most cost effective mittigation. However if the use of the illegal device rises the cost increase in insurance will eventually reach a tipping point, where the increased costs of manufacturing systems proof to this illegal device will be less than that of the insurance. Thus in a “perfect” “free market” systems proof to this illegal device would finally appear. The reality however is that the usuall “free market” “race to the bottom” in manufacturing systems will prevent such a product arising in a timely fashion if ever.

Further the Fast Moving Consumer Electronics (FMCR) market suffers from an interesting “lead time” issue. A “known want” design to market time is around 18months, it’s longer when designing for a “new want”. Thus there can be a considerable time period in which although there is a new want there is no product to satisfy it available. Thus alternative mitigations such as making the use of the illegal device very difficult or ineffective will arise much more quickly, and importantly will be usable on existing systems. Thus even though being a more costly solution it will be the more likely solution. You can see this already with the “surge protector” and power conditioning “UPS” markets…

Clive Robinson • September 13, 2016 4:39 PM

@ All,

The question of how much damage such a device can do is a complex one.

First of all it’s not a simple question of output voltage or even energy, because that is very very dependent on what damage happens in what order.

The first thing you might want to consider is that the energy it uses to do damage has to come from the USB hub in the first place… Secondly it’s output pulse is not likely to come from an avalanche device switching onto a transmission line storage element thus the rise time will not be in the picosecond speed range, nor nanosecond for that matter either. The most likely design would be a capacitor/diode ladder voltage multiplier charging some surface mount capacitor to between 100 and 600 volts and a suitable switching transistor (BJT/FET) with an effective series resistance of 0.1-1.5 ohms.

Thus it is unlikely that it attacks the USB power pin. Modern powersupplies tend to be very low impeadence and “four quadrant” capable. It might however blow the surface mount filter inductor like a fuse, but that would only stop that particular USB port working.

To do “interesting” damage it would be better if it attacked the USB signaling pins with a ramp pulse designed to get into the actuall IC and trigger metastability issues in a way that does not get clamped by the intrinsic diodes in the IC I/O pads.

The thing is that it’s only likely to effect the silicon that the USB Hub logic is in, thus the damage would be limited.

Whilst you often hear about “static damage” it rarely happens to devices that are “in circuit” as the relatively low impedence of the circuit will tend to clamp things to safe limits.

I’m not saying that such a device (you can see the circuit of one on Hackaday IIRC) will not do damage, but I suspect in many computers it will be limited, and the actual computer owner might not notice for a while.

Clive Robinson • September 15, 2016 1:03 AM

@ Bystander,

The most critical asspect is the “rise time” the faster this is the less chance any protection circuitry has to act.

Even the likes of transorbs and back to back avalanche diodes will not switch as fast as you can blow out the gate / intrinsic diodes etc on the IO pad of a modern SoC.

Thus the question of speed arises in terms of inductance and capacitance prior to the SoC package pin. The problem is that they “store energy” not “disipate energy” thus it has to go somewhere.

Whilst I do know ways of protecting such inputs they are component rich thus of higher cost than the FMCE products market will support (as I indicated earlier). Thus the solution is a “non-starter” in a “free market”. We have seen this in action in the past when it comes to “meeting regulatory requirments”. Rather than minimise unwanted energy to meet EMC masks, some suppliers used spare silicon area to make a DSSS system of the master clock frequency. Thereby spreading the energy across a much wider bandwidth rather than actually disipating it in filter components. Thus they met the EMC masks without the use of comparatively expensive filter components…