What are the risks and effects of the feared "Killer USB stick"?

Question

A Russian security researcher known as "Dark Purple" has created a USB stick that contains an unusual payload.

It doesn't install malware or exploit a zero-day vulnerability. Instead, the customized USB stick sends 220 Volts (technically minus 220 Volts) through the signal lines of the USB interface, frying the hardware.

^{Source: https://www.grahamcluley.com/2015/10/usb-killer/ and original article (in Russian): https://habrahabr.ru/post/268421/. This short YouTube video demonstrates the attack, another YouTube video shows that the computer literally starts to burn.}.

The article from Graham Cluley ends with "Yet another reason not to plug a USB stick of unknown origin into one of your computers." and that seems legit to me.

I do wonder a few things about this:

1. Is there any way that you can protect against such attacks since a normal USB port will never be able to handle 220 Volts? Or is there any way to test if the USB stick is a normal USB stick of a "kill USB stick" before using it?
2. While this is only a physical attack and will probably destroy the whole motherboard. What other damage can this do? Will it destroy data on an (modern SSD) harddrive (or chip is Ultrabooks) or the memory? Will this cause any data loss at all and is this an availability risk only or also an integrity risk in case of data loss?

Answer 1

The risks and effects are that 220 volts of electricity toast your motherboard.

With that kind of voltage and (more importantly) current, assume that if this thing gets anywhere near your hardware everything is at risk. Especially if you have sparks jumping across boards or extreme heat. Granted, it isn't designed for destroying hardware other than the computer's motherboard, but the whole "how much more damage could it cause" question seems pretty ludicrous considering that no matter what, you're going to have a fried computer. And you don't want this thing anywhere near your hardware.

As far as protection against the attack goes? First and foremost, limit physical access to your machines and have policies in place designed to improve physical security. If you don't allow anyone to use a flash drive then it makes it a lot more difficult to nonchalantly plant a usb drive.

Of course, people are also people, and if someone sees a flash drive the first instinct will be to plug it in. It's a hardware attack, so it requires a hardware solution. Is this overkill/paranoia? Yes. But it is possible to protect against something like this. Consider something like a fuse in the computer that protects against large voltages/currents flooding through the USB port. Someone plugs in a drive they shouldn't and the fuse blows, not the motherboard.

Is it a solution? Yes. Is it necessary whatsoever in a personal or even corporate environment? No. Especially if you have offsite backups of your data if any drives are damaged, the attacker wouldn't really gain anything. Now, in a military setting or industrial plant like we saw with the Stuxnet virus: https://en.wikipedia.org/wiki/Stuxnet, this might be of concern. But again, physical security like guards, cameras, and locked doors would be the first step to protecting against any hardware based threat like this.