6 October 2016Own project · Hardware securityOwn post

USB Killer vs. IBM T22: 1:0 to the stick

Summary

In October 2016 I plugged a USB Killer into a retired but still working IBM ThinkPad T22, and afterwards it was dead. This post explains how the small device takes the energy for its attack from the victim’s USB port and why almost any hardware loses. It also answers the question why you would not simply use 230 volts, and shows what this means for protecting your own devices.

A ThinkPad on its way to the scrap heap

The IBM ThinkPad T22 from the Pentium III era had seen better days and was due for the scrap heap. It still worked, though. That made it the ideal test subject for a device that was making the rounds in the tech press at the time: the USB Killer.

I filmed the test on 6 October 2016; the video is two and a half minutes long. The result is already in the description: USB Killer vs. IBM T22, 1:0. Before plugging it in, the ThinkPad was running. Afterwards it was not.

How a USB stick kills a laptop

From the outside, the USB Killer looks like an ordinary USB stick. Inside are capacitors and a charge and discharge circuit. As soon as it is plugged in, it charges its capacitors from the 5 volts the port supplies and then discharges them at around minus 200 volts through the data lines back into the computer. This repeats several times per second until someone pulls the device out.

USB data lines are built for a few volts. The manufacturer states that more than 95 percent of the devices it tested cannot withstand this. The T22 had no chance.

What you can take away: A free USB port is not only a data path but also an electrical attack surface. Anyone with physical access to a device needs neither a password nor malware for this.

Why not simply use 230 volts?

I asked myself this question for a long time: why spend around 200 euros when every wall socket delivers 230 volts? The ThinkPad would certainly have died from that too. The difference lies elsewhere.

Behind the socket is the entire power grid. It can drive a lethal current, and the housing, ports and anything you touch could suddenly be at mains voltage. That is not an experiment but a danger to life, plus a fire hazard.

The USB Killer, by contrast, only brings the small amount of energy it has just taken from the victim’s port. It needs no socket and no cable and looks like a harmless stick. That is exactly where its danger lies: not in the voltage, but in the fact that an inconspicuous object draws the energy for the attack from its target itself.

What you can take away: Keep mains voltage away from data ports. And when assessing a threat, raw power matters less than the question of how inconspicuously an attack can reach its target.

The data often survives

What remains after the attack is surprising. Researchers at the University of Hertfordshire tested the USB Killer 2.0 on various computers. The computers were unusable afterwards, but the data on the drives remained intact, on SSDs as well as on SATA disks.

What you can take away: The USB Killer is a weapon against availability, not against confidentiality. Destroying a device this way does not erase its data. If you dispose of a destroyed device, wipe or destroy the drive anyway.

Not a toy for other people’s computers

A case in the USA in 2019 showed how serious this is. A student at the College of Saint Rose in Albany destroyed 66 computers as well as monitors and lecterns with a USB Killer. The student pleaded guilty, was sentenced to twelve months in prison and has to pay 58,471 US dollars in restitution.

In Germany this would be at least criminal damage, and for computers of significant importance to others also computer sabotage under section 303b of the German Criminal Code. My T22 belonged to me and was headed for the scrap heap anyway. That is the only way such a test is acceptable.

What you can take away: Protect publicly accessible computers physically as well, for example with port blockers or locked cases. And only test hardware that belongs to you.

The device is still for sale

My USB Killer still sits in my “security” bag today. It is the USB Kill Pro Kit, which the manufacturer offers for penetration testing and law enforcement. On 1 October 2026 it was in stock on Amazon for 209.66 euros.

If you want to try it yourself: USB Kill Pro Kit on Amazon (affiliate link: if you buy something, I get a small commission and the price does not change for you). And please only on your own scrap hardware.

Numbers at a glance

The USB Killer discharges pulses of around minus 200 volts through the USB data lines, several times per second.
It draws the energy for this from the 5 volts of the attacked USB port.
In the University of Hertfordshire study, the data on SSD and SATA drives survived the attack.
At the College of Saint Rose, 66 computers were destroyed with a USB Killer in 2019; the damage amounted to 58,471 US dollars.

References

Remarks

The test was carried out on my own hardware, which was due to be scrapped.

Watch the video on YouTube