USB sticks are a major insider threat concern, but usually for either copying and stealing confidential files or possibly installing malware onto a computer or network. This case, though, involves a USB stick designed deliberately to destroy computers.

A former student of College of St. Rose in Albany, NY, purchased a “USB Killer” thumb drive. It is a device adapted to convert USB voltage to higher levels and feed it back into the computer thereby destroying at least the USB port and possibly much more.

The complaint filed against MBA graduate, Vishwanath Akuthota, was filed by FBI agent Marc Smith. Part of it reads as follows:

On February 14, 2019, the Albany Police Department responded to a report from an Assistant Director of Security for the College of St. Rose in Albany, New York. The Assistant Director reported that, earlier on February 14, 2019, a male entered several locations on campus and appeared to manually insert a device into over 50 computers which destroyed the computers motherboards, rendering the computers inoperable.

According to employees of the College of St. Rose, the damage from this incident exceeds $50,000. Employees of the College of St. Rose provided law enforcement with video surveillance of the locations where the computers were destroyed. I have personally reviewed that video surveillance, which reflects a male wearing a red sweatshirt, blue jeans, black sneakers, and gray backpack enter the locations where the computers are located and insert what appears to be a device into the computers.

Law enforcement has compared the male from that video surveillance with known images of Vishwanath Akuthota and believes that the individual depicted in the video surveillance damaging the computers is Vishwanath Akuthota. Further, employees of the College of St. Rose familiar with Vishwanath Akuthota, a graduate of the College of St. Rose, confirmed that the individual depicted in the video surveillance was Vishwanath Akuthota.

Unfortunately, you purchase almost anything online these days, from bugging devices, to covert cameras, to, yes, USB Killers.

USB-Killer devices sold on ebay.

One ebay ad explains:

NOTE: Only for testing and research, any disputes and adverse consequences shop is not responsible for, please consider carefully before buying! ! !
The product does not contain a battery, but it generates high voltage during operation (the booster circuit output is fixed at 300V, and when the output is connected to the load, the voltage is pulled down to the discharge threshold voltage, the center value is 230V, and the error is ±30%). Therefore, do not remove or damage the heat-shrinkable tube skin attached to this product (the heat-shrinkable tube has a withstand voltage of 600V). If the heat-shrinkable tube skin is damaged, stop using it.
If any abnormal conditions such as abnormal output voltage (too high or too low), abnormal sound, excessive heat or even fire occur during operation, immediately turn off the power.

At least they warn you about the possibility of fire. But they fail to mention the other possibility of up to 10 years in prison, paying over $50,000 in damages and potential $250,000 penalty that Vishwanath Akuthota faces.

You can read more about this case at the Naked Security blog by Sophos [here].

Criminal Complaint files [here].

Plea deal for Vishwanath Akuthota [here].