'Suspicious' USB fan given out at Trump-Kim summit deemed safe

A University of Cambridge researcher wanted to know if the fan was bugged.

(Image: @HaraldDoornbos)

Sometimes, a fan is just a fan.

Speculation began to spark after reporters were given a USB-powered fan during the recent Singapore summit where President Donald Trump met North Korean leader Kim Jong-un.

After all, the weather was in the 80-degree range and humidity was through the roof.

Read also: Inside North Korea's mysterious military - CNET

But one of the cardinal rules of cybersecurity is to never plug in a USB device without knowing where it came from, or what's on it, because you never know what's on it. USB flash drives can contain malware -- even USB devices like fans or keyboards and mice -- can silently infect your computer. You can even get trick USB devices that destroy your computer.

Given the stakes of the meeting, coupled with the known cyber-warfare capabilities of both the US and North Korea and ongoing threats to the media, journalists were warned not to plug in the fans.

They were smart not to. But, in this case, it turns out at least one of the fans was safe.

In a short, two-page paper published by University of Cambridge security researcher Sergei Skorobogatov, one sample fan was not found to contain any components that could result in damage.

The government of Singapore denied that the fans were capable of conducting espionage, but rumors continued to swirl.

Leo Mirani, an editor at The Economist, sent Skorobogatov one of the fans from the summit.

"Turns out they're benign," Mirani said in a tweet.

Skorobogatov, who is also known for his iPhone 5c security research and did not immediately respond to a request for comment, tore down the fan and conducted a few tests. He said that if there was any software functionality present, "it would require connections of a malicious semiconductor chip" on the [data lines], but he found nothing untoward about the device.

"This particular sample of USB fan does not have any computer functionality on USB interface," he confirmed. "It can only be used for driving the motor from USB power."

Read also: North Korea's history of bold cyber attacks

Ross Anderson, professor of security engineering at Cambridge University, said that it was a conspiracy theory "proved wrong for once."

"At least, if there was a microphone, it was hidden well enough for even Sergei to miss it," he joked.

But with hundreds of these identical-looking fans given out to reporters during the summit, it's not to say that the one in your bag is safe, too.

Got a tip?

You can send tips securely over Signal and WhatsApp at 646-755–8849. You can also send PGP email with the fingerprint: 4D0E 92F2 E36A EC51 DAAE 5D97 CB8C 15FA EB6C EEA5.

Read More