A former student at the College of Saint Rose destroyed at least 66 University computers using a USB Killer. The 27-year-old Indian national, Vishwanath Akuthota, pleaded guilty this week to destroying the computers. He now faces up to ten years in prison and a maximum of $250,000 in fines.
The incident occurred on February 14, 2019. Further, although Akuthota, originally pleaded not guilty to the charges, he later admitted to the crime. He inserted the weaponized USB into 59 Microsoft Window computers, 7 Apple iMac computer workstations, and numerous monitors and digital podiums with USB ports.
USB Killer sends over 100 volts into the USB port when connected; destroying the port and other hardware in the machines. According to the Department of Justice, the former student knew what the device would do once it was inserted.
During the incident, Akuthota recorded himself using his phone, inserting the malicious device into the computers. The complaint released by the Department of Justice stated:
“The defendant, using his personal iPhone, recorded himself inserting the ‘USB Killer’ device into computers and other hardware owned by the college, and making statements including, “I’m going to kill this guy,” then inserting the ‘USB Killer’ device into a USB port, and – after destroying the host device – stating “it’s dead”, and, in another instance, “it’s gone. Boom.”
The incident cost the university over $58,000 in damages and employee time. The defendant must pay the university for the damage according to his plea agreement.
Currently, the motivation behind the crime is unclear, however, this crime raises concerns and the need for physical security. A cybersecurity strategy can be useless if a malicious actor can easily come on to the premises and carry out a crime using physical devices.
Contact LIFARS for penetration testing services today.