How to protect from the USB Kill Stick

[nctnico]

I don't see much use for this device. It can't be used to test something in a controlled and repeatable manner (like what happens during ESD and surge testing for compliance testing).

[Psi]

You really think people who build/sell these things try to get the device compliance/EMC tested?

[T3sl4co1l]

How to protect?

Give me $200 and I'll give you a circuit that should work.

Give me $2000 and I'll give you a circuit that will work.

Give me $20,000 and we can go to the testing lab and blow it up with real lightning simulators...

Besides TVS or clamp diodes, there are CCS-biased diodes (which have been used in Tektronix DSO input stages before), current limiting diodes*, MOVs, GDTs, and so on.  It's really just a matter of getting the right stackup of parts to preserve the intended signal, while handling the rest within ratings.

*Nowadays restricted to depletion mode MOSFETs, which are available with quite reasonable Rds(on), Vds(max) and Idss.  A pair of DN3545, back to back, can do a fine job, without costing much capacitance (series or to-ground).

Also,

You really think people who build/sell these things try to get the device compliance/EMC tested?

They are.  In a manner of speaking.

Most standards allow test equipment to be noisy, which after all, might be the whole point when it comes to transient generators.  Such equipment is required to be used by technicians in shielded laboratory environments.  Whether that's enforced (and what those terms mean), well...

Tim

[Psi]

This 0.1MW TVS diode would probably do the job
http://www.digikey.co.nz/product-detail/en/microsemi-ire-division/MRT100KP45A/1086-7745-ND/4354082

[Siwastaja]

What would the bridge diode + TVS diode configuration look like?

What they probably mean is the most widely used, standard protection idea of using fast, low-capacitance schottkys from the signal to both rails, you know, the one used in many protected CMOS inputs;  except that one of the diodes would not go to the +5V line, but a specific "protection" rail consisting of a low-ESR, low-inductance capacitance and the slow protection device that can dissipate a lot of power - think of a huge zener, or an active crowbar circuit. This protection rail could be pre-biased from the 5V line through a big resistor and a diode, for example.

[T3sl4co1l]

Look at the internal diagram of this, for instance (p.6):
www.st.com/resource/en/datasheet/tsx3702.pdf
All pins have diodes directing excess voltage into an ESD clamp circuit.  The diodes are PN junction type, not particularly fast, but low capacitance and very low leakage.  They are just big enough to handle the surge currents required.  The ESD clamp circuit is big enough to withstand the full surge, and will take up an appreciable amount of die area.  Fortunately, the diodes can be relatively small, and so the clamp circuit does not need to be repeated for each pin on the device!

Under normal conditions, the clamp circuit has some leakage and some capacitance.  But under operating conditions, it's biased up by the power supply, so only diode leakage flows, which is small.  Unlike some devices, you can push the inputs up above +V, but you incur the leakage of the clamp circuit.  It's better than diode-clamped parts (where the input must be below VDD+0.3V or current-limited), but worse than unclamped (danger!) or zener-clamped parts.

74LVC logic is "5V tolerant", so it has zener diode protection, which has to be per-pin.  This is a big part of the cost in making discrete logic: it takes a lot of charge to swing all that capacitance by 3.3V or more, and part of the reason why high speed logic and signalling is all low voltage differential (LVDS, TMDS, CML, differential ECL..).

More ideas:
http://www.onsemi.com/pub_link/Collateral/AND8230-D.PDF


Tim

[tatus1969]

fit large TVS diodes across your 5V and data lines, and live with 12mb/s usb,

A TVS at the data lines? Have an idea of the capacitance these have?  This comes close to the suggestion that I had in mind. Take a small sheet of steel, drill four holes in it, and bolt it down in front of the USB ports. Makes them fairly resistant to that USB killer.

Apart from joking, does anyone have a rough figure of the charge that the USB killer throws at us? If I assume that all the capacitors total to 20uF at 100V, this would be 0.1 joules then. That would be way more than any USB ESD clamp can handle that I know of.

[tatus1969]

Optoisolating the ports would certainly do the job - but also make the ports uber expensive (try to optoisolate USB 3!) and useless for powering anything.

Still the isolated side would get destroyed.

We have to dissipate that charge somewhere, and we have to maintain data comms. So we need a clamp that has low capacitance. So how about using a normal USB ESD clamp, and add a series resistor between them and the socket terminals.

A quick simulation shows that a 10 ohms series resistor will already reduce the charge dumped into the zener to 1/10th. Will that be enough? Todays USB data line protection is only designed to handle ESD discharge. Considering HBM = 100pF at 8kV this is only 3.3mJ. Here I still have 11.6mJ.

[tatus1969]

A 15kV 100pF HBM ESD source packs 11.25mJ or power

Hey, that answers my question in my last post 

[2N3055]

USB3 dataline ESD protection devices have capacity on the order of 0.2-0.5 pF !!!

Edges on USB3 data lines are at 50 ps (picoseconds) range..

So I don't think 100pF would be good for signal integrity...

[tatus1969]

USB3 dataline ESD protection devices have capacity on the order of 0.2-0.5 pF !!!

Edges on USB3 data lines are at 50 ps (picoseconds) range..

So I don't think 100pF would be good for signal integrity...

who mentioned 100pF?

[poorchava]

I use a USB isolator based on ADuM3160 for connecting all potentially dangerous stuff. Learned the hard way when a circuit debugging went sideways and I lost the mobo in my PC.

Sent from my HTC One M8s using Tapatalk

[2N3055]

USB3 dataline ESD protection devices have capacity on the order of 0.2-0.5 pF !!!

Edges on USB3 data lines are at 50 ps (picoseconds) range..

So I don't think 100pF would be good for signal integrity...

who mentioned 100pF?

Many devices that can sink any significant current...

If you're going to do something that works, it has to have very low capacity....


But we are looking at this in a wrong way...

It shouldn't have to be permanent over-voltage device...

Lets design something that isolates USB completely at first, powers up the stick, and if it doesn't detect funny behaviour, connects it in a few secs...

So no circuit would be connected in parallel with data lines while working...

A sort of behaviour of antivirus when you connect stick: scan first, and then you get to connect..
If you put a uC on it you could actually try to mount USB and check if it is in fact a functional USB device...

[tatus1969]

I use a USB isolator based on ADuM3160 for connecting all potentially dangerous stuff. Learned the hard way when a circuit debugging went sideways and I lost the mobo in my PC.

Sent from my HTC One M8s using Tapatalk

A pity that these only support USB1.1.

[Whales]

Are there comms lasers that operate over a wide power range?  ie ones that can do high-speed comms at normal USB signal current levels but can also handle large energy pulses without complaining?

I definitely agree with the ideas of fighting back.  Make sure to get the USB port to enter a high-voltage 'self-cleaning' mode immediately after retaliation and forced ejection.

[Kalvin]

Why don't you use wall-powered USB 3.0 hub? That should provide at least some protection so that your MB won't get fried?

[Fungus]

I definitely agree with the ideas of fighting back.

Yeah, teach that capacitor a lesson it won't forget... 

[Fungus]

A sort of behaviour of antivirus when you connect stick: scan first, and then you get to connect..
If you put a uC on it you could actually try to mount USB and check if it is in fact a functional USB device...

So... all I need to do is add a small microcontroller to my USB kill stick and I can bypass all your defenses. It can pretend to be a real USB device for five seconds before zapping you. Five seconds would give the capacitors time to charge nicely.

[2N3055]

A sort of behaviour of antivirus when you connect stick: scan first, and then you get to connect..
If you put a uC on it you could actually try to mount USB and check if it is in fact a functional USB device...

So... all I need to do is add a small microcontroller to my USB kill stick and I can bypass all your defenses. It can pretend to be a real USB device for five seconds before zapping you. Five seconds would give the capacitors time to charge nicely.

Like I said, it is like with viruses, you can't stop the back and forth game... Likewise, if you make a surge protector, i can always make a stick with more energy and burn trough...

But unlike viruses, that can come unnoticed, somebody has to hand you this crap, and you have to willingly put it in USB port for some reason...

And while now they are claiming some "testing bullshit" as a reason to sell and own this, if you did all that you said (and possibly more..) to SURPASS protection schemes, than by making and owning one of those you are proving malevolent and deliberately designing, making and using a device to do deliberate destruction...... And that is clearly illegal..

Some time ago there was a scam, where a pretty girl with a t-shirt with a logo of a well know company was giving away USB sticks, also with a logo of that company..
Like a normal marketing campaign.. Except USB sticks had zero-day root kit on it to spy on your PC (and to make it more fun, it wasn't only M*soft target on it)..
So you take it (it was free, right?) put it in a pocket... One of these days you need a stick, and use it...

They might have as well given you one of these USB killers...

Morale of the story: Like you mother told you , don't take candies from a stranger ........

As I sad before, it doesn't bother me personally, I see no scenario that I would stick a thing like that in my PC without knowing who was to blame... In that case they would pay for the damage... Case closed.

In a public, unattended use, whatever you want to damage, just slam it with a hammer.... No need for USB bull***t...

[dom0]

Besides TVS or clamp diodes, there are CCS-biased diodes (which have been used in Tektronix DSO input stages before), current limiting diodes*, MOVs, GDTs, and so on.  It's really just a matter of getting the right stackup of parts to preserve the intended signal, while handling the rest within ratings.

The CCS-biased diode bridge approach may be workable, for USB 2.0 at least, since it has been used to protect 50 ? inputs with beyond 500 MHz bandwidth in decades long past. Another advantage is that it doesn't have to dissipate the energy - unless the voltage becomes just too high.

[janoc]

I was actually thinking about this - USB 3.0 is AC coupled by default (as far as I know). Shouldn't just adding one of those little wide band RF transformers do the trick? They would go into saturation as soon as they'd get too much power and just not transfer it. They are cheap enough.

Not sure whether USB 3 is AC coupled, but that doesn't help you any if the pulse goes to the power rails. Even then you still have the USB 2.x data pins in every USB 3 connector which cannot be AC coupled, because the various DC voltages on them are used for service signalling - bus reset, speed detection, etc.

Those RF transformers have probably such parasitics that it would make the communication impossible.

[janoc]

Still the isolated side would get destroyed.

Yep, but probably cheaper to replace a blown isolator than the entire mobo. However, it is not really a practical solution.

[dom0]

Still the isolated side would get destroyed.

Yep, but probably cheaper to replace a blown isolator than the entire mobo. However, it is not really a practical solution.

Depends on the motherboard. Desktop hardware is far less expensive than mobile hardware (while, of course, having far higher performance), for example. A new motherboard will often cost less than 100 euros.

[janoc]

Depends on the motherboard. Desktop hardware is far less expensive than mobile hardware (while, of course, having far higher performance), for example. A new motherboard will often cost less than 100 euros.

You wouldn't have optoisolated USB ports on $100 class motherboards. High speed optoisolators cost much more than that - e.g. the optical USB 3.0 cable from Corning starts at 140 EUR. Even if we assume 50% margin (which is very generous), the cost of such solution would be prohibitive. That's why I have said it is not a practical solution.

[tszaboo]

How do you protect it from the Etherkiller?

How do you protect it from people throwing a pitchfork into the socket
Driving into it with a forklift?
Shooting high explosive anti tank ammunition at it?

There is reasonable protection, like HBM ESD. Protecting it against the USB killer is not reasonable.