What Is A USB Killer And Just How Much Damage Can They Do?

When you think of USB sticks, you probably see them as portable storage devices. However, they can also serve other useful purposes beyond just storage. That said, not all of these uses are harmless. A seemingly ordinary-looking USB stick could destroy a computer within seconds after being plugged in. These malicious devices are known as "USB Kill Sticks" or "USB Killers."

The way a USB Killer works is simple. When you plug it into a device, it rapidly charges and discharges capacitors within the device to deliver a series of high-voltage electrical surges — damaging the connected hardware. The consequences can be severe; in 2019, for example, the Department of Justice announced that a man had been charged with causing $58,000 to computer hardware at a college in New York using a USB killer.

These USB Kill sticks can destroy almost any USB-compatible device, including computers, smart TVs, smartphones, and even high-end gaming consoles. However, the extent of the damage varies depending on the device. For instance, a USB Kill stick doesn't seem to destroy Apple's MacBook Air M2 entirely, but it does render its ports unusable. 

USB Kill sticks were originally made by a Hong Kong-based security team. Over the years, multiple versions of these devices have been developed, with the latest one being version 4, which starts at $59. Its "Kit" version comes with a variety of adapters, which let one use the stick with all kinds of devices, including smartphones, printers, storage drives, network equipment, and more.

These newer versions of USB Kill sticks are even more dangerous, as they don't necessarily need power from the connected device. The version 4 USB Kill sticks feature internal batteries, which let them destroy devices even when they are powered off. Further, conducting an attack in offline mode also allows the USB Kill stick to bypass the USB-C and Lightning security protocols used in smartphones.

The version 4 USB Kill sticks can be activated in multiple ways. For instance, they can be operated remotely using a dedicated remote control or a smartphone. Some models even allow users to schedule an attack at a specific time and date. All of this makes it extremely difficult to identify the attacker.

USB Kill sticks are used by manufacturers to stress test their devices. They are also used by government agencies and law enforcement. However, since these USB Kill sticks are also sold commercially, they can easily fall into the wrong hands and be misused. A famous example occurred in 2019 when a former College of Saint Rose student used a USB Killer to destroy 66 computers worth $58,000. 

Protecting a computer from USB Kill sticks is challenging. Even if you disable USB ports by modifying group policy settings, these devices can still deliver a destructive electrical surge and cause damage. The only reliable way to protect your computer or any device from a USB Kill stick is to avoid plugging one in. To further safeguard your devices, you may consider physically sealing the USB ports.

If you must use a USB stick but are unsure of its effects, you can get a USB Kill Shield for $25. This device allows the USB stick to receive power as usual while blocking any power surge attacks. It also features an LED light that flashes upon detecting an attack. Additionally, it can also help protect your device from data theft and malware. If you don't wish to buy a USB Kill Shield, it's a good idea to first test a USB stick with an old, inexpensive machine before plugging it into your main computer or other valuable devices.